# GlassWorm

> As of 2026-06-16, GlassWorm is a N/A-nexus threat actor tracked by Threadlinqs Intelligence across 6 threats spanning supply chain, malware. Also known as GlassWorm Campaign, GlassWorm Group. ATT&CK coverage spans 77 techniques across 14 tactics in 6 of 6 tracked threats. Most-observed techniques: T1027 (Obfuscated Files or Information), T1195 (Supply Chain Compromise), T1041 (Exfiltration Over C2 Channel).

- **Nation:** N/A
- **Tracked threats:** 6
- **Categories:** SUPPLY_CHAIN, MALWARE
- **Also known as:** GlassWorm Campaign, GlassWorm Group
- **As of:** 2026-06-16

## ATT&CK techniques observed

77 techniques observed across 6 of 6 tracked threats. Tactics: Stealth (formerly Defense Evasion) (12), Command and Control (10), Credential Access (9), Execution (7), Persistence (7), Discovery (6).

- [T1027](https://intel.threadlinqs.com/technique/T1027) Obfuscated Files or Information — Stealth (formerly Defense Evasion) — observed in 6 of 6 tracked threats
- [T1195](https://intel.threadlinqs.com/technique/T1195) Supply Chain Compromise — Initial Access — observed in 6 of 6 tracked threats
- [T1041](https://intel.threadlinqs.com/technique/T1041) Exfiltration Over C2 Channel — Exfiltration — observed in 5 of 6 tracked threats
- [T1005](https://intel.threadlinqs.com/technique/T1005) Data from Local System — Collection — observed in 4 of 6 tracked threats
- [T1059](https://intel.threadlinqs.com/technique/T1059) Command and Scripting Interpreter — Execution — observed in 4 of 6 tracked threats
- [T1199](https://intel.threadlinqs.com/technique/T1199) Trusted Relationship — Initial Access — observed in 4 of 6 tracked threats
- [T1555](https://intel.threadlinqs.com/technique/T1555) Credentials from Password Stores — Credential Access — observed in 4 of 6 tracked threats
- [T1036](https://intel.threadlinqs.com/technique/T1036) Masquerading — Stealth (formerly Defense Evasion) — observed in 3 of 6 tracked threats
- [T1090](https://intel.threadlinqs.com/technique/T1090) Proxy — Command and Control — observed in 3 of 6 tracked threats
- [T1102](https://intel.threadlinqs.com/technique/T1102) Web Service — Command and Control — observed in 3 of 6 tracked threats
- [T1105](https://intel.threadlinqs.com/technique/T1105) Ingress Tool Transfer — Command and Control — observed in 3 of 6 tracked threats
- [T1176](https://intel.threadlinqs.com/technique/T1176) Software Extensions — Persistence — observed in 3 of 6 tracked threats
- [T1204](https://intel.threadlinqs.com/technique/T1204) User Execution — Execution — observed in 3 of 6 tracked threats
- [T1496](https://intel.threadlinqs.com/technique/T1496) Resource Hijacking — Impact — observed in 3 of 6 tracked threats
- [T1543](https://intel.threadlinqs.com/technique/T1543) Create or Modify System Process — Persistence — observed in 3 of 6 tracked threats

## Tracked threats

- [GlassWASM: TinyGo WebAssembly Malware in Open VSX Extensions Using Solana Blockchain Dead-Drop C2 (GlassWorm Successor)](https://intel.threadlinqs.com/threat/TL-2026-0816) — CRITICAL
- [GlassWorm Developer Supply Chain Campaign Takedown — CrowdStrike + Google + Shadowserver Disrupt 4-Channel C2 (Solana / BitTorrent DHT / Google Calendar / VPS)](https://intel.threadlinqs.com/threat/TL-2026-0603) — HIGH
- [GlassWorm v2 — 73 Open VSX Sleeper Extensions Activate Supply Chain Malware Against VS Code, Cursor, Windsurf and VSCodium Developers](https://intel.threadlinqs.com/threat/TL-2026-0421) — CRITICAL
- [GlassWorm Supply Chain Attack via Trojanized VS Code Extensions on Open VSX](https://intel.threadlinqs.com/threat/TL-2026-0247) — CRITICAL
- [GlassWorm Supply Chain Campaign: 73 Malicious Open VSX Extensions Using Transitive Dependencies](https://intel.threadlinqs.com/threat/TL-2026-0224) — HIGH
- [GlassWorm macOS Attack via Compromised OpenVSX Extensions](https://intel.threadlinqs.com/threat/TL-2026-0034) — HIGH

## Full data

Infrastructure, IOC values and detection queries (Splunk SPL / Microsoft KQL / Sigma) require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/actor/GlassWorm