Since at least early 2025, Glassworm's operators systematically targeted software developers — a population with privileged access to source code repositories, cloud platforms, CI/CD pipelines, and package registries. Compromising a single developer's workstation can cascade into a supply-chain breach impacting thousands of downstream organizations and end users.

The attackers deployed a multi-pronged campaign: Trojanized VS Code extensions were published to the Open VSX marketplace, masquerading as popular tools like time trackers and code formatters, targeting editors including Cursor, Positron, Windsurf, and VSCodium. Compromised npm and Python packages executed malicious code silently through postinstall hooks and setup scripts during routine dependency installation.

Using stolen developer credentials harvested from earlier infections, the group force-pushed malicious code into the default branches of more than 300 GitHub repositories. The operation was fully cross-platform, targeting Windows, macOS, and Linux, and included a full-featured Node.js remote access tool known as GlasswormRAT.

Glassworm's command-and-control architecture was deliberately engineered to survive traditional takedown attempts, relying on four distinct channels. First, the Solana blockchain: C2 server addresses were encoded in transaction memo fields, creating an immutable dead-drop that cannot be taken offline through conventional means. Second, the BitTorrent Distributed Hash Table (DHT): GlasswormRAT queried the peer-to-peer network for configuration data against hardcoded public keys, leveraging a global decentralized network with no single point of failure.

Third, a public calendar service: Glassworm exploited Google Calendar event titles as dead-drop locations for Base64-encoded C2 paths. Fourth, direct VPS server connections served as the final payload delivery mechanism. This layered architecture — combining blockchain, peer-to-peer networks, and legitimate web services — was designed to keep the actual C2 servers hidden behind multiple layers of indirection.

Disrupting this setup required perfect timing. Taking down any single channel would have allowed operators to quickly reconstitute from the remaining infrastructure. All four channels had to be hit simultaneously — which is precisely what CrowdStrike, Google, and Shadowserver achieved at 14:00 UTC on May 26, 2026.

The Glassworm takedown sets a new model for how the security community must approach software supply-chain threats. It demonstrates that proactive disruption is achievable even against infrastructure deliberately engineered for resilience, and that precision strikes can cripple criminal operations without requiring years of judicial process.

The case underscores that cross-sector collaboration works: combining threat intelligence from private industry with platform cooperation from technology companies creates the conditions for decisive action. By severing command-and-control, infected machines are immediately freed from adversary control, giving organizations the critical window they need to detect and remediate compromises.

To help organizations determine whether they have been affected, CrowdStrike disclosed a key network indicator: all Glassworm-infected machines now beacon to a benign CrowdStrike-operated sinkhole IP at 164.92.88[.]210. Organizations should review network logs and endpoint telemetry for connections to this address — any match indicates a Glassworm infection requiring immediate remediation.

Key Takeaways

• →CrowdStrike, Google, and the Shadowserver Foundation simultaneously dismantled all four Glassworm command-and-control channels on May 26, 2026, in a landmark coordinated operation.
• →Glassworm poisoned more than 300 GitHub repositories, deployed malicious VS Code extensions, and compromised npm and Python packages, targeting developers across Windows, macOS, and Linux.
• →The botnet's C2 infrastructure used Solana blockchain, BitTorrent DHT, Google Calendar event titles, and commercial VPS servers — an unusually sophisticated resilience architecture designed to survive standard takedowns.
• →CrowdStrike assessed the operators as likely Russia-based, based on CIS country locale checks in the malware code and Russian-language comments throughout the source.
• →Organizations should check network logs for connections to the sinkhole IP 164.92.88[.]210 — any match indicates a Glassworm infection requiring immediate remediation.
• →The takedown signals that the software supply chain can no longer rely on detection alone — active, cross-industry disruption of adversary infrastructure is now essential to defending the open-source ecosystem.