# Glassworm Botnet Dismantled: Researchers Disrupt Resilient Blockchain-Based C2 Network Targeting Software Developers


A sophisticated botnet known as Glassworm has been disrupted following a coordinated takedown of its distributed command-and-control (C2) infrastructure—infrastructure that relied on decentralized technologies including Solana blockchain transactions and the BitTorrent DHT network to evade traditional law enforcement and security industry disruption efforts.


The campaign, which primarily targeted software developers and vendors as part of supply-chain attack operations, demonstrated advanced evasion techniques designed to circumvent conventional infrastructure takedowns. The disruption represents a significant victory against an adversary group that has long posed threats to critical software supply chains, though researchers caution that similar architectures may already be in use by other threat actors.


## The Threat: Glassworm's Supply-Chain Focus


Glassworm has been tracked by security researchers as a botnet operation focused on compromising developers and software distribution pipelines. Rather than casting a wide net for random targets, the group's strategy centered on precision targeting of development environments and build systems—areas that, once compromised, could grant attackers access to downstream users of affected software.


This approach aligns with broader trends in contemporary threat activity, where adversaries increasingly recognize the asymmetric value of supply-chain compromise. A single backdoor injected into widely-used software can potentially affect thousands or millions of end users, making software vendors and development teams priority targets.


The botnet's victims typically found themselves infected through:

  • Trojanized development tools and utilities
  • Malicious dependencies inserted into package repositories
  • Watering-hole attacks targeting developer forums and communities
  • Spear-phishing campaigns with technical credibility targeting engineering teams

    • ## Background and Context: The Evolution of Resilient C2


    Traditional botnet command-and-control infrastructure has long been vulnerable to disruption. Law enforcement agencies, internet service providers, and security researchers have developed mature playbooks for:

  • Identifying and seizing web servers hosting C2 panels
  • Coordinating with DNS registrars to sinkhole malicious domains
  • Pressuring hosting providers to shut down adversary infrastructure
  • Court-ordered seizures and international cooperation efforts

    • Glassworm's operators, however, adopted a fundamentally different approach by leveraging decentralized infrastructure that eliminates traditional points of failure.


    ### Solana Blockchain Exploitation


    The use of Solana blockchain transactions represented an innovative—if troubling—shift in C2 architecture design. Rather than relying on centralized servers, Glassworm operators encoded command messages within blockchain transaction data. Key characteristics of this approach included:


    | Advantage | Description |

    |-----------|-------------|

    | Decentralization | No single server to seize or shut down |

    | Immutability | Commands recorded permanently on-chain; difficult to remove |

    | Pseudonymity | Transactions could be obfuscated with addresses difficult to trace |

    | Resilience | Network continues functioning regardless of traditional takedowns |

    | Accessibility | Freely accessible transaction history available to any observer |


    Infected systems would periodically query the Solana blockchain, extract encoded commands from specific wallet addresses or transaction patterns, and execute directives without requiring direct communication with attacker-controlled servers.


    ### BitTorrent DHT as Secondary Infrastructure


    Complementing the blockchain-based C2, Glassworm operators also embedded command data within BitTorrent Distributed Hash Table (DHT) entries. The DHT is a peer-to-peer network layer used by BitTorrent clients to discover file sources without relying on centralized trackers.


    This dual-layer architecture provided:

  • Redundancy: If blockchain channels were compromised, DHT could serve as a fallback
  • Traffic camouflage: Commands hidden within normal BitTorrent network activity
  • Geographic distribution: No central point of control vulnerable to law enforcement

    • ## Technical Details: How Disruption Was Achieved


    Security researchers successfully disrupted Glassworm's infrastructure through a combination of technical analysis, infrastructure monitoring, and coordinated intervention:


    ### Detection and Analysis

    Researchers identified infected systems through:

  • Behavioral analysis: Monitoring for unusual Solana blockchain queries from non-financial hosts
  • Network telemetry: Tracking patterns of DHT requests for command data
  • Malware reverse engineering: Analyzing captured Glassworm samples to understand C2 communication protocols

    • ### Infrastructure Takedown Strategy

    Rather than attempting to "seize" decentralized infrastructure—an impossible task—researchers employed alternative approaches:


  • Blockchain analysis: Identified wallet addresses associated with command distribution and mapped attacker operations
  • ISP coordination: Worked with internet service providers to identify and notify organizations hosting infected systems
  • Signature distribution: Coordinated with antivirus vendors and endpoint detection providers to identify and remove Glassworm malware
  • Public disclosure: Published indicators of compromise (IOCs) enabling broader threat hunting across the security community

    • ## Implications for Organizations and Defenders


    The Glassworm disruption carries several important implications:


    ### Supply-Chain Vigilance Required

    Organizations must assume that sophisticated adversaries continue targeting their development infrastructure. Critical control points include:

  • Source code repository access controls (GitHub, GitLab, internal systems)
  • Build pipeline security and artifact integrity verification
  • Dependency management and third-party library vetting
  • Developer endpoint security and workstation hardening
  • Code-signing infrastructure protection

    • ### Evolution of C2 Architecture

    Glassworm's use of blockchain and DHT demonstrates that traditional C2 takedown strategies are insufficient against determined adversaries. Organizations defending against botnets should anticipate:

  • Increased adoption of decentralized C2 by remaining threat groups
  • Hybrid architectures combining multiple resilient channels
  • Challenges in complete infrastructure elimination requiring long-term hunting and remediation

    • ### Detection and Response Challenges

    The distributed nature of blockchain and DHT-based C2 makes detection more difficult for security operations centers. Organizations should implement:

  • Anomalous outbound connection monitoring for non-standard protocols and patterns
  • Network segmentation to limit lateral movement by compromised development systems
  • Behavioral analytics on development infrastructure to identify command execution anomalies

    • ## Recommendations for Software Development Organizations


    Immediate Actions:

  • Scan development infrastructure for Glassworm indicators of compromise (IOCs published by researchers)
  • Review recent code commits and artifacts for signs of unauthorized modification
  • Audit access logs for development tools, repositories, and build systems from the past 12 months
  • Review employee device security posture and endpoint detection coverage

    • Medium-Term Hardening:

  • Implement code-signing requirements for all software artifacts
  • Deploy supply-chain attestation and verification frameworks (SLSA, Software Supply Chain Levels)
  • Require multi-factor authentication across all development infrastructure
  • Establish isolated build environments with minimal internet connectivity

    • Long-Term Resilience:

  • Adopt zero-trust architecture principles within development networks
  • Invest in software composition analysis (SCA) tools to identify compromised dependencies earlier
  • Participate in industry information-sharing groups focused on supply-chain security
  • Maintain incident response playbooks specific to supply-chain compromise scenarios

    • ---


    ## HackWire Analysis


    The Glassworm disruption highlights a critical inflection point in adversary sophistication: when traditional infrastructure becomes too vulnerable to disruption, nation-state and sophisticated criminal actors shift toward inherently decentralized architectures. Glassworm's use of Solana blockchain and BitTorrent DHT wasn't experimental—it was operational convergence of two mature decentralized systems that required no point of legal vulnerability.


    The timing matters here. As law enforcement has become increasingly effective at seizing traditional botnet infrastructure—witness the recent takedowns of LockBit, Qakbot, and other major families—the remaining sophisticated actors are methodically moving toward architectures that simply cannot be "seized" in any traditional sense. This represents a fundamental shift in the offensive-defensive balance.


    What other reporting misses: the blockchain angle generates headlines, but the **real innovation is the *hybrid* architecture**—Solana as primary channel, DHT as fallback, likely encrypted and obfuscated commands within both. Attackers learned from Mirai's downfall (single ISP dependency) and from traditional C2 takedowns (single server dependency). Glassworm operationalized defense-in-depth for botnet C2.


    For defenders, the concrete implication is this: you can no longer assume your defensive tools will detect "external" compromise vectors. Malware phoning home to a Solana wallet for commands won't trigger traditional "suspicious domain" alerts. Endpoint detection platforms need behavioral baselines of what blockchain queries look like from legitimate development tools (there shouldn't be any in 99% of organizations) so that anomalous blockchain activity becomes a high-fidelity hunting signal.


    The second-order concern: if Glassworm can operationalize decentralized C2 at this sophistication level, any moderately skilled APT can implement similar architectures within weeks. Expect to see this pattern replicate.


    — HackWire Editorial


    ---


    ## Related Coverage


  • Read more in our [Malware](https://www.hackwire.news/category/malware) coverage
  • Cross-reference with [Breaches](https://www.hackwire.news/category/breaches) and [Vulnerabilities](https://www.hackwire.news/category/vulnerabilities)
  • Stay current via the [HackWire homepage](https://www.hackwire.news/)