Archive — US — techcrunch
CrowdStrike and Google take down botnet used by hackers to target softwaredevelopers in supply chain attacks
CrowdStrike, alongside Google and Shadowserver, has dismantled the Glassworm botnet, which was targeting open-source software developers for two years. The cybercriminals used various strategies, including malicious extensions and stolen credentials, to compromise code repositories. This operation disrupts significant supply chain vulnerabilities as hackers directly target the developers behind software.
Key points
- CrowdStrike, Google, and Shadowserver collaborated to disrupt the Glassworm botnet.
- The botnet had targeted open-source software developers for two years.
- Attackers used strategies like publishing malicious extensions on developer marketplaces and employing malvertising tactics.
- Compromising a single developer can affect thousands downstream, showcasing the high-value target nature of developers.
- The operation resulted in the takedown of four command-and-control channels.
- Glassworm hackers poisoned over 300 GitHub repositories with malicious code.
Why it matters
- Supply chain attacks have been increasingly prevalent, highlighting vulnerabilities in IT infrastructures.
- In 2023, there was a rise in targeted attacks against software development processes and packages.
- The rise of open-source dependency on platforms like GitHub boosts the risk of supply chain vulnerabilities.
- Other recent hacking campaigns, such as the Mini Shai-Hulud operation, illustrate ongoing threats in the open-source community.
The takedown of the Glassworm botnet by CrowdStrike and partners underscores the critical need for cybersecurity measures focused on developers and supply chain integrity in software development.