GlassWorm Developer Supply Chain Campaign Takedown — CrowdStrike + Google + Shadowserver Disrupt 4-Channel C2 (Solana / BitTorrent DHT / Google Calendar / VPS) — Threadlinqs Intelligence
As of 2026-05-30, GlassWorm Developer Supply Chain Campaign Takedown — CrowdStrike + Google + Shadowserver Disrupt 4-Channel C2 (Solana / BitTorrent DHT / Google Calendar / VPS) is a high-severity supply chain threat attributed to GlassWorm Operators (Russia), tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 49 indicators of compromise.
Threat ID: TL-2026-0603 · Severity: HIGH · Status: MONITORING · Category: SUPPLY_CHAIN
Attribution: GlassWorm Operators · Russia · FINANCIAL
On 2026-05-27 CrowdStrike, Google, and the Shadowserver Foundation announced the simultaneous neutralization of all four C2 channels used by GlassWorm, the first self-propagating worm targeting the VS
GlassWorm is a self-propagating supply chain worm first publicly disclosed by Koi Security on 2025-10-18 after the actor compromised 7 OpenVSX extensions on 2025-10-17 (later expanded to 13 OpenVSX + 1 VS Code Marketplace extension `cline-ai-main.cline-ai-agent` v3.1.3 on 2025-10-19; ~35,800 cumulative installations) and resurfaced on 2025-11-06 with three more OpenVSX extensions (`ai-driven-dev.ai-driven-dev`, `adhamu.history-in-sublime-merge`, `yasuyuky.transient-emacs`; ~10,000 installations).
**Invisible-code stealth.** The worm hides its bootstrap in invisible Unicode variation selectors injected into otherwise benign-looking JavaScript inside the extension's `extension.js`. To a human reviewer or static scanner the malicious line renders as whitespace; the V8 / Node interpreter, however, executes it verbatim. This is the first observed weaponization of Unicode variation selectors as a packer for marketplace extensions.
**Four-channel resilient C2.** GlassWorm operators built a deliberately redundant C2 stack so that no single takedown could disable the botnet:
1. **Solana blockchain (primary discovery channel)** — Wallet `28PKnu7RzizxBzFPoLp69HLXp9bJL3JFtT2s5QzHsEA2` issues SPL transactions whose `memo` instruction field contains the current C2 URL. The malware queries a public Solana RPC endpoint, walks the wallet's transaction list, and decodes the most recent memo to obtain a fresh staging URL. Three known config-update transactions (`49CDiVWZpu…`, `3eVTqgEVdU…`, `3v3jCvKfdv…`) were observed between 2025-10-15 and 2025-11-06.
2. **Google Calendar dead drop** — Public calendar `https://calendar.app.google/M2ZCvM8ULL56PD1d6` owned by `uhjdclolkdn@gmail.com`. Event titles encode fallback C2 URLs. Removed during the takedown after coordination with Google's Threat Analysis Group.
3. **BitTorrent DHT** — The ZOMBI module joins the public Mainline DHT and uses peer announce / get_peers traffic against attacker-controlled info-hashes as a covert configuration channel. Disrupted by Shadowserver via DHT sinkholing.
4. **Commercial VPS** — Direct hardcoded fallback servers `217.69.3.218` and `199.247.10.166` (BL Networks / Vultr ranges) serving the second-stage archive at `/get_arhive_npm/` and `/get_zombi_payload/<base64>`. Exfiltration sinks on `140.82.52.31:80/wall` and `199.247.13.106:80/wall`.
**GlassWormRAT (Stage 2).** A WebSocket-based JavaScript RAT loaded from `http://217.69.3.218/get_arhive_npm/` after the bootstrap decodes the Solana memo. It establishes a wss:// session for live tasking and exposes commands for credential harvesting (NPM `~/.npmrc`, GitHub PATs from `gh` config and OS keyring, OpenVSX publisher tokens, Git credential helper, environment variables), crypto-wallet theft against 49 known browser extensions (MetaMask, Phantom, Coinbase Wallet, Trust Wallet, Solflare, Backpack, Keplr, Rabby, OKX, Brave Wallet, etc.), and lateral repo compromise — using the stolen GitHub credentials to push AI-generated, plausibly-worded malicious commits into 300+ repos starting 2025-10-31.
**ZOMBI module (Stage 3).** Final payload that converts the workstation into multi-protocol proxy infrastructure. ZOMBI fuses four sub-components: (a) a SOCKS5 server bound to a high port and tunneled out-bound to the C2; (b) Hidden VNC giving operators a full desktop session indistinguishable from the user's; (c) WebRTC peer routing for NAT traversal and P2P remote-execution; (d) BitTorrent DHT participation for resilient discovery. The resulting botnet was sold/used as a residential-proxy and malware-distribution backbone.
**Chrome extension implant.** GlassWormRAT side-loads an unpacked Chromium extension into developer profiles (Chrome, Brave, Edge, Arc) granting it `tabs`, `scripting`, `storage`, and `<all_urls>` host permissions. It exfiltrates full-page screenshots on tab change, keystrokes via injected content-scripts, and clipboard contents on every focus event — yielding 2FA codes, password-manager autofill, and recov
Weaknesses (CWE)
CWE-506, CWE-1395, CWE-829, CWE-94
Target sectors: technology, software-development, government, financial, cryptocurrency, open-source-maintainers
Target regions: Global, North America, Europe, Middle East, Asia
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 49 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
SUPPLY_CHAIN, HIGH, threat intelligence, cybersecurity, T1195, T1195.001, T1195.002, T1059.007, T1204.002, T1547.001, T1543.001, T1176, T1027, T1027.013