CrowdStrike and Google take down botnet used by hackers to target software developers in supply chain attacks

In a significant cybersecurity operation, CrowdStrike, in collaboration with Google and the nonprofit Shadowserver, successfully dismantled a botnet that was being used by cybercriminals to distribute malware and capture passwords from open-source software developers. This initiative aimed to thwart the activities of the Glassworm botnet, which has been a persistent threat to the open-source software supply chain for over two years. Recent months have seen an alarming rise in attacks targeting developers and open-source projects, leading to the distribution of harmful software to various companies and organizations. These attacks are particularly effective as they exploit the inherent trust that businesses place in code hosted on platforms like GitHub. In their report, CrowdStrike emphasized that the focus of adversaries has shifted: "Developers represent uniquely high-value targets: compromising a single developer’s workstation can cascade into a supply-chain compromise that impacts thousands of downstream organizations and users." The hackers behind the Glassworm operation employed various tactics to disseminate their malicious code. These included releasing harmful extensions on developer marketplaces, utilizing malvertising techniques to mislead victims into downloading malware, and leveraging stolen credentials from prior breaches to hijack developer accounts and insert malware into their projects. According to CrowdStrike, more than 300 GitHub repositories were compromised through these methods. In this decisive action, CrowdStrike managed to disable four command-and-control channels used by the Glassworm hackers, effectively severing their access to infected systems and preventing further malware distribution. The command-and-control infrastructure utilized a range of platforms, including the Solana blockchain, the BitTorrent network, Google Calendar, and various virtual private servers. While the specifics of the legal and technical basis for this operation remain unclear, CrowdStrike's intervention has dealt a significant blow to the Glassworm hacking group. This follows a recent spate of attacks, including one known as “Mini Shai-Hulud,” where multiple open-source projects were compromised, resulting in the distribution of malicious updates. In an earlier incident in March, a suspected North Korean hacker gained control of the widely-used open-source development tool Axios, impacting millions of developers.