Hackers Target Open-Source Software Developers with Malware and Password Theft

Cybercriminals have been exploiting the trust placed in open-source software to push malicious code to companies and organizations. This has led to supply-chain compromises affecting thousands of downstream users.

Takedown of Glassworm Botnet

A joint operation between CrowdStrike, Google, and Shadowserver has led to the takedown of the Glassworm botnet. The botnet was used by hackers to target open-source software developers and push malware and steal passwords. The operation aimed to disrupt the activities of the cybercriminals behind the Glassworm botnet, who have been targeting the broader open-source software supply chain for two years.

• The Glassworm hackers used several strategies to push out their malicious code, including publishing malicious extensions on a marketplace used by developers, malvertising, and using credentials stolen in previous hacks to hijack developer accounts and plant malware in their code.
• The hackers were able to poison more than 300 GitHub code repositories.
• CrowdStrike was able to takedown four command-and-control channels used by the Glassworm hackers, which cut the hackers’ access to infected computers and stopped them from delivering more malware.

The command-and-control servers relied on the Solana blockchain, the BitTorrent peer-to-peer network, Google Calendar, and virtual private servers. However, it's unclear what legal or technical authority CrowdStrike and others operated under to take down the operation.

"Adversaries are no longer just targeting products, they're targeting the developers who build them," CrowdStrike wrote in its report about the takedown operation. "Developers represent uniquely high-value targets: compromising a single developer's workstation can cascade into a supply-chain compromise that impacts thousands of downstream organizations and users.\