Glassworm Botnet Disrupted After Resilient C2 Infrastructure Takedown

Cybersecurity experts have achieved a significant victory against the Glassworm botnet, which specialized in targeting developers through vulnerabilities in software supply chains. Attackers employed unconventional methods to maintain their command-and-control infrastructure, including integration with the Solana blockchain and the BitTorrent DHT distributed network.

The uniqueness of this approach lay in the transmission of commands to infected devices via blockchain transactions, making it difficult to detect and block botnet activity. Additionally, the use of the decentralized BitTorrent DHT network ensured high fault tolerance, allowing attackers to quickly restore control even after partial disruptions.

Researchers successfully identified and neutralized key nodes of the infrastructure, leading to the disruption of the entire botnet. Preliminary assessments suggest that attacks using Glassworm could have caused severe damage to software development companies, including source code leaks and the insertion of malicious components into legitimate products.

Experts note that such supply chain attacks are becoming increasingly common and emphasize the need to strengthen security measures at all stages of software development and distribution. Specifically, they recommend implementing multi-factor authentication, regular code audits, and monitoring for suspicious activity in networks.