How to detect/clean GlassWorm

-


What was GlassWorm?

GlassWorm is a sophisticated supply‑chain malware campaign that targeted software developers and the open‑source ecosystem. 

Key traits:

  • Spread via:
    • Malicious VS Code / OpenVSX extensions
    • Compromised npm and Python packages
    • Poisoned GitHub repositories 
  • Goal:
    • Steal credentials (GitHub, npm, cloud tokens)
    • Exfiltrate crypto wallets and secrets
    • Take over developer accounts and propagate further 
  • Big risk:
    • One compromised developer → downstream supply‑chain compromise impacting many organizations 

 Why it was so dangerous

GlassWorm was unusually hard to stop because of its resilient, multi-layered command-and-control (C2) design:

  • Solana blockchain → stored C2 addresses (immutable “dead drops”)
  • BitTorrent DHT → decentralized config distribution
  • Google Calendar → hidden encoded commands
  • Traditional servers → payload delivery 

👉 This meant:

Taking down one channel didn’t matter—the malware would just switch to another.

 What “disrupted” means

On May 26–27, 2026, a coordinated operation by:

  • CrowdStrike
  • Google
  • Shadowserver Foundation

simultaneously took down all four C2 channels. 

Result:

  • Attackers lost control of infected systems
  • Malware couldn’t receive new commands or payloads
  • Botnet effectively neutralized (disrupted) 

 Scope of the campaign

Before disruption:

  • Active since October 2025 
  • Hundreds of software artifacts and repos affected (300–400+) 
  • Tens of thousands of developers potentially exposed 

 Important: “Disrupted” ≠ “Gone”

Even though the infrastructure was taken down:

  • Infected machines may still exist
  • Stolen credentials can still be abused
  • Operators could rebuild infrastructure

Security researchers stress the threat actors are persistent and well-resourced 

 Bottom line

  • GlassWorm = advanced developer-targeting supply-chain malware
  • Disrupted = its control infrastructure was taken offline in a coordinated strike
  • Impact = major win for defenders, but not necessarily permanent

If you want, I can break down how to detect/clean GlassWorm in an enterprise environment or what indicators to look for—especially relevant given your sysadmin role

DETECTION — What to look for

GlassWorm hides in developer tooling and supply chains, so focus on dev endpoints and CI/CD systems first.

 Endpoint Indicators (dev machines)

Check for:

Suspicious developer artifacts

  • Unknown or recently installed:
    • VS Code / OpenVSX extensions
    • npm / pip packages
  • Especially anything installed outside approved repos or internal mirrors
<pre><code> // 
# Node
npm ls -g --depth=0

# Python
pip list

# VS Code extensions
code --list-extensions
 </code></pre>

Red flag: packages/extensions you didn’t explicitly approve.

🔐 Credential access activity

GlassWorm targets:

  • ~/.ssh
  • ~/.aws
  • ~/.config/gcloud
  • Git credential helpers

Check:

  • Unexpected file reads or exfil attempts
  • New/modified SSH keys
  • Recently accessed token files

🌐 Network anomalies

Look for these behaviors:

  • Connections to:
    • BitTorrent/DHT traffic (UDP-heavy, random peers)
    • Blockchain APIs (Solana RPC endpoints)
    • Google Calendar API from non-browser processes
  • Repeated DNS queries with encoded data patterns
# Example quick checks
netstat -ano
Get-NetTCPConnection # PowerShell

🧩 Code & Repo Indicators

Compromised repos/packages

  • Unexpected commits (especially:
    • obfuscated JS/py code
    • base64 blobs
    • eval(), exec())
  • Maintainer account changes
  • Release versions that:
    • differ from source
    • include injected scripts
grep -r "eval(" .
grep -r "base64_decode" .
``

⚙️ CI/CD Pipeline Indicators

  • New build steps added silently
  • Secrets accessed during builds unexpectedly
  • Builds reaching external endpoints (non-whitelisted)

 2. CONTAINMENT — Stop the spread fast

 Immediate actions (high priority)

1. Isolate infected systems

  • Remove from network (EDR quarantine or VLAN isolation)

2. Revoke ALL credentials from affected systems

  • GitHub / GitLab tokens
  • npm, PyPI tokens
  • AWS / Azure keys
  • SSH keys

👉 Assume token theft already happened

3. Block known abuse channels

At firewall / proxy level:

  • BitTorrent / DHT traffic
  • Solana RPC endpoints
  • Suspicious Google API patterns

4. Freeze affected repos

  • Lock pushes
  • Disable CI pipelines temporarily
  • Audit recent commits

 3. ERADICATION — Cleaning infected hosts

 Option A (recommended): Rebuild

GlassWorm is stealthy → safest path is:

✅ Wipe and reimage dev machines

Then:

  • Install only approved tooling
  • Enforce package allowlists

🛠️ Option B: Manual cleanup (if rebuild not possible)

Remove malicious artifacts

  • Uninstall unknown VS Code extensions
  • Remove suspicious npm/pip packages
npm uninstall -g <package>
pip uninstall <package>

Kill persistence mechanisms

Check:

  • Startup scripts:
    • ~/.bashrc, .zshrc
    • Windows Run keys
  • Scheduled tasks
  • Cron jobs
  • Verify system binaries
  • Run integrity checks (EDR or file hash baseline)
  • Look for replaced tooling (node, python wrappers)

 4. RECOVERY — Secure re-entry

 Credentials reset (critical)

  • Rotate:
    • API keys
    • SSH keys
    • OAuth tokens
  • Force developer password resets

Audit supply chain

  • Rebuild all artifacts from:
    • clean source
    • trusted dependencies
  • Re-publish known-good package versions

 Strengthen controls

✅ Implement:

  • Dependency allowlisting
  • Private package registries (Artifactory, Nexus)
  • Signed packages (Sigstore, etc.)

✅ Enforce:

  • MFA everywhere (GitHub, cloud)
  • Least privilege tokens

 5. PREVENTION — Future hardening

Developer environment controls

  • Block:
    • direct npm/pip installs from internet
  • Force:
    • internal mirrors only

Monitoring rules to add

SIEM / EDR detections:

  • Processes accessing:
    • SSH keys + network connections simultaneously
  • Non-browser apps hitting:
    • Google APIs
  • DHT / P2P traffic from dev machines

Git security

  • Signed commits required
  • Branch protections enforced
  • Alert on:
    • new maintainers
    • token usage from new locations

 Quick Triage Checklist

If you suspect GlassWorm:

  • Identify dev machines with new packages/extensions
  • Check for unusual outbound traffic (DHT/blockchain/API)
  • Revoke all credentials immediately
  • Freeze repos + audit commits
  • Rebuild affected machines
  • Rotate all secrets

 Reality Check

Glass Worm is dangerous because:

  • It moves through trust chains (developers → packages → orgs)
  • It steals credentials before you notice
  • It persists across multiple channels

👉 So assume:

If one dev box is hit → your supply chain may be impacted


Comments

Post a Comment