Threat Intelligence / Actor / PhantomRaven

PhantomRaven

As of 2026-08-25, PhantomRaven is a Russia-nexus threat actor tracked by Threadlinqs Intelligence across 1 threat spanning malware. Also known as GlassWorm Operator.

Nation: Russia · 1 tracked threat(s) · Categories: MALWARE

Also known as: GlassWorm Operator

Tracked threats

GlassWorm v3 Supply Chain Attack — 72 Malicious Open VSX Extensions, 151 GitHub Repos & ZOMBI Botnet Module — HIGH

Full actor intelligence — infrastructure, IOCs, detection coverage and operator fingerprints — is available via the Threadlinqs MCP server (Purple tier). View plans →

Threadlinqs Intelligence