Related Threat Clusters
-
Glassworm Botnet Targeting Developers Disrupted by CrowdStrike and Google
The Glassworm botnet, which has targeted software developers since early 2025, was taken down in a coordinated operation by CrowdStrike, Google, and the Shadowserver Foundation on May 26, 2026. This botnet utilized…
30 articles · Updated May 27, 2026 -
Armored Likho Expands Cyber-Espionage with New Rust Toolkit
In May 2026, the Armored Likho group, also known as Eagle Werewolf, launched a cyber-espionage campaign targeting private individuals and organizations in Russia, including corporations, government bodies, and…
2 articles · Updated August 13, 2026 -
GlassWorm Malware Resurfaces in Open VSX Extensions Following Token Leak
The Open VSX registry faced a supply chain attack after access tokens were leaked, allowing threat actors to publish malicious extensions. The GlassWorm malware campaign has returned with new extensions targeting…
15 articles · Updated November 11, 2025 -
GlassWorm Malware Resurfaces in Open VSX and GitHub
GlassWorm malware has reappeared on the Open VSX registry and in GitHub repositories, infecting three additional VS Code extensions. This resurgence follows its removal from the official marketplace, as reported by Koi…
6 articles · Updated November 10, 2025
Recent Intelligence Reports
- Dead Drop Resolver — attack.mitre.org · August 14, 2026
- CrowdStrike and Google have blocked 'Glassworm,' a botnet targeting open — Gigazine · May 28, 2026
- CrowdStrike, Google slay 'unkillable' Glassworm botnet targeting devs — www.itnews.com.au · May 27, 2026
- Malware Still Active: GlassWorm Found Again in Open-VSX Packages — Heise.De · November 11, 2025