🤚 The Open-Palm Takedown

On May 27, 2026, a coordinated strike by CrowdStrike, Google, and The Shadowserver Foundation dismantled Glassworm, a botnet that had been quietly parasitizing the software development supply chain since October 2025. The operation targeted what security researchers are calling one of the most architecturally creative command-and-control infrastructures ever deployed in the wild.

Glassworm’s business model was elegant in its depravity: plant malicious extensions on OpenVSX and Microsoft’s VS Code Marketplace, seed poisoned packages across npm and GitHub repositories, and wait for developers to install them like trusting golden retrievers accepting treats from strangers. At its peak, a single campaign compromised more than 400 software artifacts — extensions, packages, and repositories — all designed to siphon cryptocurrency wallets and developer credentials.

But the pièce de résistance wasn’t the malware. It was how Glassworm phoned home.

👐 The Two-Handed Infrastructure Review

Most botnets use a command-and-control server the way most restaurants use a kitchen: one location, one function, easy to shut down if the health inspector shows up. Glassworm looked at this model and said “what if we were four restaurants simultaneously, and one of them was a blockchain?”

The botnet maintained four simultaneous C2 channels:

• Solana blockchain transactions — C2 server addresses were encoded in the memo fields of on-chain transactions, creating what researchers described as “an immutable, publicly accessible dead drop.” The blockchain doesn’t do takedowns. The blockchain doesn’t do anything except exist, permanently, like a parking ticket on the windshield of the internet.
• BitTorrent DHT — Configuration data was distributed through the peer-to-peer network using hardcoded public keys, exploiting a global decentralized network with no single point of failure. Your torrent client’s routing table was, technically, an accessory.
• Google Calendar — Event titles contained Base64-encoded C2 paths. Yes. Google Calendar. The botnet had better scheduling hygiene than most project managers.
• Direct VPS connections — Traditional commercial hosting for payload delivery, because even cybercriminals need a reliable fallback.

The tactical problem was immediately obvious: take down any single channel, and the operators simply pivot to the other three. It’s the hydra problem, except the hydra has a Google Workspace subscription.

🌿 The Gentle Awakening

The takedown succeeded because all three organizations agreed to hit every channel at once. CrowdStrike handled the VPS infrastructure. Google nuked the Calendar abuse. Shadowserver coordinated the blockchain and DHT disruption. Compromised machines now beacon to a CrowdStrike-controlled IP at 164.92.88.210, confirming the botnet is effectively lobotomized.

But here’s the part that should keep you awake: dozens of dormant extensions were sitting quietly on OpenVSX, waiting for a future update to activate their payloads. The extensions were clean on installation. They only became malicious after an update — which means the marketplace’s scanning infrastructure approved them, because they were clean. The malware was a calendar invite that hadn’t been accepted yet.

We’ve now reached the stage of supply chain security where the attack surface includes your IDE’s extension marketplace, your package manager, your blockchain’s memo field, your torrent client’s routing table, and your Google Calendar. If your threat model doesn’t include “what if my calendar app is a dead drop,” congratulations — you are officially behind.

👑 The Gold-Leaf Postmortem

Glassworm is dead, but its architecture is a blueprint. The multi-channel C2 approach — particularly the use of immutable blockchain transactions as a fallback — represents a genuine evolution in botnet resilience. The next operator who copies this playbook may not make the mistake of also using Google Calendar, which, let’s be honest, was the digital equivalent of hiding your spare key under a doormat that Google owns.

The broader lesson is that developer toolchains are now the premium attack surface. Not because developers are careless, but because the ecosystem is built on trust — trust in registries, trust in package signatures, trust in the little blue “verified” badge that means approximately nothing when the verification happened before the payload arrived.

CrowdStrike, Google, and Shadowserver pulled off a genuinely impressive coordinated takedown. But the fact that it required three organizations attacking four channels simultaneously just to shut down one botnet tells you everything about where this is headed.

“The botnet used Solana for immutability, BitTorrent for resilience, Google Calendar for scheduling, and a VPS for tradition. It had better distributed systems architecture than most Series B startups.” — The Slap of Wisdom Threat Intelligence Desk, currently auditing its own VS Code extensions and finding three it doesn’t remember installing