{"id":9831,"date":"2026-05-28T15:55:20","date_gmt":"2026-05-28T19:55:20","guid":{"rendered":"https:\/\/hostingdiscussion.com\/news\/?p=9831"},"modified":"2026-05-28T14:16:18","modified_gmt":"2026-05-28T18:16:18","slug":"crowdstrike-takes-down-glassworm-botnet-that-spent-two-years-poisoning-developer-code","status":"publish","type":"post","link":"https:\/\/hostingdiscussion.com\/news\/crowdstrike-takes-down-glassworm-botnet-that-spent-two-years-poisoning-developer-code\/","title":{"rendered":"CrowdStrike takes down Glassworm botnet that spent two years poisoning developer code"},"content":{"rendered":"<p class=\"font-claude-response-body break-words whitespace-normal leading-[1.7]\"><a href=\"https:\/\/www.crowdstrike.com\/en-us\/\" target=\"_blank\" rel=\"noopener noreferrer nofollow\">CrowdStrike<\/a>, working alongside Google and nonprofit internet monitor <a href=\"https:\/\/www.shadowserver.org\/\" target=\"_blank\" rel=\"noopener noreferrer nofollow\">Shadowserver<\/a>, has dismantled a botnet called Glassworm, which spent roughly two years targeting open source software developers to push malware and harvest stolen credentials across the supply chain.<\/p>\n<p class=\"font-claude-response-body break-words whitespace-normal leading-[1.7]\">The operation cut off four command-and-control channels the hackers relied on to communicate with infected machines and deliver additional malware. What makes the infrastructure notable is how unconventional it was. Rather than relying solely on traditional servers, the Glassworm operators routed their control channels through the <a href=\"https:\/\/solana.com\/\" target=\"_blank\" rel=\"noopener noreferrer nofollow\">Solana<\/a> blockchain, the BitTorrent peer-to-peer network, Google Calendar, and virtual private servers. The mix made detection and disruption considerably harder.<\/p>\n<p class=\"font-claude-response-body break-words whitespace-normal leading-[1.7]\">By the time the operation wrapped up, the hackers had poisoned more than 300 GitHub repositories. The word &#8220;poisoned&#8221; is CrowdStrike&#8217;s own, and it fits. Because developers pull code from repositories they trust, a compromised package can travel silently into products used by thousands of organizations downstream. The victim never touches the hackers directly.<\/p>\n<p class=\"font-claude-response-body break-words whitespace-normal leading-[1.7]\">The Glassworm group used several methods to reach developers. These included publishing malicious extensions on developer marketplaces, paying for sponsored search results that directed victims toward infected downloads, and using credentials stolen in earlier breaches to hijack developer accounts and plant malware directly inside their existing projects. The combination gave the group multiple entry points into the same ecosystem.<\/p>\n<p class=\"font-claude-response-body break-words whitespace-normal leading-[1.7]\">&#8220;Adversaries are no longer just targeting products, they&#8217;re targeting the developers who build them,&#8221; CrowdStrike noted in its report. The logic is simple: one compromised developer workstation can affect every project that person touches, and every organization using those projects downstream.<\/p>\n<p class=\"font-claude-response-body break-words whitespace-normal leading-[1.7]\">The takedown comes against a backdrop of intensifying supply chain attacks. Just last week, a separate campaign called Mini Shai-Hulud compromised several open source projects through malicious updates, with at least two OpenAI developers among those affected. In March, a suspected North Korean hacker hijacked Axios, the widely used JavaScript library that millions of developers depend on daily.<\/p>\n<p class=\"font-claude-response-body break-words whitespace-normal leading-[1.7]\"><a href=\"https:\/\/hostingdiscussion.com\/news\/crowdstrike-closes-15-minute-detection-gap-that-gives-cloud-attackers-room-to-cause-real-damage\/\">CrowdStrike<\/a> has not detailed the specific legal or technical authority under which the Glassworm takedown was conducted, and the company declined to comment further beyond its published report. Even so, the operation offers a rare public look at how defenders are starting to respond to supply chain threats at the infrastructure level, rather than waiting for individual incidents to surface.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>CrowdStrike, working alongside Google and nonprofit internet monitor Shadowserver, has dismantled a botnet called Glassworm, which spent roughly two years targeting open source software developers to push malware and harvest stolen credentials across the supply chain. The operation cut off four command-and-control channels the hackers relied on to communicate with infected machines and deliver additional [&hellip;]<\/p>\n","protected":false},"author":20624,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1],"tags":[1947,6862,6861,6859,213,313,6860],"class_list":["post-9831","post","type-post","status-publish","format-standard","hentry","category-uncategorized","tag-crowdstrike","tag-developer-targeted-cyberattack","tag-github-malware","tag-glassworm-botnet","tag-google","tag-open-source","tag-supply-chain-attack"],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v23.2 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>CrowdStrike takes down Glassworm botnet that spent two years poisoning developer code - Web Hosting News<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/hostingdiscussion.com\/news\/crowdstrike-takes-down-glassworm-botnet-that-spent-two-years-poisoning-developer-code\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"CrowdStrike takes down Glassworm botnet that spent two years poisoning developer code - Web Hosting News\" \/>\n<meta property=\"og:description\" content=\"CrowdStrike, working alongside Google and nonprofit internet monitor Shadowserver, has dismantled a botnet called Glassworm, which spent roughly two years targeting open source software developers to push malware and harvest stolen credentials across the supply chain. The operation cut off four command-and-control channels the hackers relied on to communicate with infected machines and deliver additional [&hellip;]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/hostingdiscussion.com\/news\/crowdstrike-takes-down-glassworm-botnet-that-spent-two-years-poisoning-developer-code\/\" \/>\n<meta property=\"og:site_name\" content=\"Web Hosting News\" \/>\n<meta property=\"article:published_time\" content=\"2026-05-28T19:55:20+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-05-28T18:16:18+00:00\" \/>\n<meta name=\"author\" content=\"Justine Juyad\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Justine Juyad\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"2 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/hostingdiscussion.com\/news\/crowdstrike-takes-down-glassworm-botnet-that-spent-two-years-poisoning-developer-code\/\",\"url\":\"https:\/\/hostingdiscussion.com\/news\/crowdstrike-takes-down-glassworm-botnet-that-spent-two-years-poisoning-developer-code\/\",\"name\":\"CrowdStrike takes down Glassworm botnet that spent two years poisoning developer code - Web Hosting News\",\"isPartOf\":{\"@id\":\"https:\/\/hostingdiscussion.com\/news\/#website\"},\"datePublished\":\"2026-05-28T19:55:20+00:00\",\"dateModified\":\"2026-05-28T18:16:18+00:00\",\"author\":{\"@id\":\"https:\/\/hostingdiscussion.com\/news\/#\/schema\/person\/3a1732732b90f8c57c2a0ec68d3c49e3\"},\"breadcrumb\":{\"@id\":\"https:\/\/hostingdiscussion.com\/news\/crowdstrike-takes-down-glassworm-botnet-that-spent-two-years-poisoning-developer-code\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/hostingdiscussion.com\/news\/crowdstrike-takes-down-glassworm-botnet-that-spent-two-years-poisoning-developer-code\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/hostingdiscussion.com\/news\/crowdstrike-takes-down-glassworm-botnet-that-spent-two-years-poisoning-developer-code\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/hostingdiscussion.com\/news\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"CrowdStrike takes down Glassworm botnet that spent two years poisoning developer code\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/hostingdiscussion.com\/news\/#website\",\"url\":\"https:\/\/hostingdiscussion.com\/news\/\",\"name\":\"Web Hosting News\",\"description\":\"Cloud and web hosting industry daily news\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/hostingdiscussion.com\/news\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/hostingdiscussion.com\/news\/#\/schema\/person\/3a1732732b90f8c57c2a0ec68d3c49e3\",\"name\":\"Justine Juyad\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/hostingdiscussion.com\/news\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/96df33d01870f85226adf8492251fbefe00bc349b10bb7679b094f3fa086999c?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/96df33d01870f85226adf8492251fbefe00bc349b10bb7679b094f3fa086999c?s=96&d=mm&r=g\",\"caption\":\"Justine Juyad\"},\"description\":\"HostingDiscussion.com senior reporter\",\"sameAs\":[\"https:\/\/hostingdiscussion.com\/news\/\"],\"url\":\"https:\/\/hostingdiscussion.com\/news\/author\/justine-juyad\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"CrowdStrike takes down Glassworm botnet that spent two years poisoning developer code - Web Hosting News","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/hostingdiscussion.com\/news\/crowdstrike-takes-down-glassworm-botnet-that-spent-two-years-poisoning-developer-code\/","og_locale":"en_US","og_type":"article","og_title":"CrowdStrike takes down Glassworm botnet that spent two years poisoning developer code - Web Hosting News","og_description":"CrowdStrike, working alongside Google and nonprofit internet monitor Shadowserver, has dismantled a botnet called Glassworm, which spent roughly two years targeting open source software developers to push malware and harvest stolen credentials across the supply chain. The operation cut off four command-and-control channels the hackers relied on to communicate with infected machines and deliver additional [&hellip;]","og_url":"https:\/\/hostingdiscussion.com\/news\/crowdstrike-takes-down-glassworm-botnet-that-spent-two-years-poisoning-developer-code\/","og_site_name":"Web Hosting News","article_published_time":"2026-05-28T19:55:20+00:00","article_modified_time":"2026-05-28T18:16:18+00:00","author":"Justine Juyad","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Justine Juyad","Est. reading time":"2 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/hostingdiscussion.com\/news\/crowdstrike-takes-down-glassworm-botnet-that-spent-two-years-poisoning-developer-code\/","url":"https:\/\/hostingdiscussion.com\/news\/crowdstrike-takes-down-glassworm-botnet-that-spent-two-years-poisoning-developer-code\/","name":"CrowdStrike takes down Glassworm botnet that spent two years poisoning developer code - Web Hosting News","isPartOf":{"@id":"https:\/\/hostingdiscussion.com\/news\/#website"},"datePublished":"2026-05-28T19:55:20+00:00","dateModified":"2026-05-28T18:16:18+00:00","author":{"@id":"https:\/\/hostingdiscussion.com\/news\/#\/schema\/person\/3a1732732b90f8c57c2a0ec68d3c49e3"},"breadcrumb":{"@id":"https:\/\/hostingdiscussion.com\/news\/crowdstrike-takes-down-glassworm-botnet-that-spent-two-years-poisoning-developer-code\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/hostingdiscussion.com\/news\/crowdstrike-takes-down-glassworm-botnet-that-spent-two-years-poisoning-developer-code\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/hostingdiscussion.com\/news\/crowdstrike-takes-down-glassworm-botnet-that-spent-two-years-poisoning-developer-code\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/hostingdiscussion.com\/news\/"},{"@type":"ListItem","position":2,"name":"CrowdStrike takes down Glassworm botnet that spent two years poisoning developer code"}]},{"@type":"WebSite","@id":"https:\/\/hostingdiscussion.com\/news\/#website","url":"https:\/\/hostingdiscussion.com\/news\/","name":"Web Hosting News","description":"Cloud and web hosting industry daily news","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/hostingdiscussion.com\/news\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/hostingdiscussion.com\/news\/#\/schema\/person\/3a1732732b90f8c57c2a0ec68d3c49e3","name":"Justine Juyad","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/hostingdiscussion.com\/news\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/96df33d01870f85226adf8492251fbefe00bc349b10bb7679b094f3fa086999c?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/96df33d01870f85226adf8492251fbefe00bc349b10bb7679b094f3fa086999c?s=96&d=mm&r=g","caption":"Justine Juyad"},"description":"HostingDiscussion.com senior reporter","sameAs":["https:\/\/hostingdiscussion.com\/news\/"],"url":"https:\/\/hostingdiscussion.com\/news\/author\/justine-juyad\/"}]}},"views":121,"_links":{"self":[{"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/posts\/9831","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/users\/20624"}],"replies":[{"embeddable":true,"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/comments?post=9831"}],"version-history":[{"count":1,"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/posts\/9831\/revisions"}],"predecessor-version":[{"id":9832,"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/posts\/9831\/revisions\/9832"}],"wp:attachment":[{"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/media?parent=9831"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/categories?post=9831"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/tags?post=9831"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}