CrowdStrike, Google, And Shadowserver Foundation Disrupt Glassworm Botnet
CrowdStrike has shared details of a coordinated operation used to disable the Glassworm botnet, which targets software developers and leverages open-source ecosystems to deploy malware.
The CrowdStrike Counter Adversary Operations team, in partnership with Google and the Shadowserver Foundation, took down all four C2 centers of the Glassworm network on 26 May by disrupting all lines of communication between Glassworm’s controllers and infected systems. This prevented additional malicious payloads from being delivered.
CrowdStrike said Glassworm was a worldwide attack against software developers via the open-source software ecosystem. The threat actors employed malicious VSCode plug-ins, poisoned Python and npm packages, and compromised GitHub repos to deploy a malware strain that could exfiltrate credentials and establish remote access.
The botnet’s robustness was a result of its adoption of several Command & Control channels, namely, the SolanaBlockchain, BitTorrent DHT network, Google Calendar, and Virtual Private Servers. CrowdStrike stated that it simultaneously disrupted...
Copyright of this story solely belongs to informationsecuritybuzz.com. To see the full text click HERE
