CrowdStrike, Google, and Shadowserver Disrupt Glassworm Botnet Targeting Developers (infosecurity-magazine.com)

• Glassworm botnet active since early 2025, targeting developers.
• Simultaneous takedown of four C2 layers: VPS, Google Calendar, BitTorrent, Solana blockchain.
• Linked to supply chain attacks on VS Code, npm, Python, and GitHub.
• CrowdStrike warns of shift toward targeting developer environments.

"CrowdStrike, Google, and the Shadowserver Foundation collaborated to disrupt the Glassworm botnet, which had been targeting software developers since early 2025. They simultaneously took down all four C2 channels, including traditional servers, Google Calendar events, peer-to-peer networks, and Solana blockchain memo fields. The botnet was used in supply chain attacks via malicious VS Code extensions, npm packages, and Python packages."