CrowdStrike, Google, Shadowserver Disrupt Glassworm Botnet via Multi-Channel C2 Takedown
Researchers from CrowdStrike, Google and The Shadowserver Foundation simultaneously shut down Glassworm’s four resilient command‑and‑control channels—including Solana blockchain, BitTorrent DHT, Google Calendar and traditional VPS servers—effectively halting the developer‑targeting botnet active since October 2025. Infected hosts now beacon to a CrowdStrike IP, and YARA rules have been published for detection.