Glassworm Botnet Infrastructure Disrupted: Solana and DHT C2 Analysis

The Glassworm botnet represents a sophisticated evolution in decentralized C2 infrastructure designed to evade traditional network perimeter defenses. According to BleepingComputer, researchers have disrupted this operation, which specifically targeted developers via Supply Chain Attack vectors. By leveraging the Solana blockchain and the BitTorrent Distributed Hash Table (DHT), the actors maintained a persistent footprint that bypassed standard IP-based blocking and domain blacklisting.

Technical Analysis: Glassworm Botnet Solana C2 Mechanism

The Glassworm operation primarily distributed its payload through malicious npm packages. This TTP allows the actor to compromise the workstation of a developer, which frequently serves as a high-value gateway for Lateral Movement into internal production environments and cloud infrastructure. The malware utilizes a dual-layered communication strategy to receive commands and update its internal configuration.

The first layer involves the Solana blockchain. Glassworm utilizes transaction metadata on the Solana network to store encrypted instructions or updated C2 addresses. Because Solana is a legitimate, high-volume blockchain, SOC teams often find it difficult to distinguish between legitimate decentralized application traffic and malicious signaling. This technique bypasses firewall rules that typically target static domains. By querying public Solana RPC nodes, the malware can retrieve its next stage of instructions without ever communicating directly with an actor-controlled server in a way that triggers traditional reputation-based alerts.

Analyzing Glassworm BitTorrent DHT Persistence Analysis and Impact

The second layer of the infrastructure relies on the BitTorrent DHT network. In this phase of the attack, the malware uses the DHT to locate peer nodes that host additional components or update files. By using a decentralized network rather than a central server, the Glassworm operators ensured that the shutdown of a single IP address would not disable the entire botnet. This reliance on peer-to-peer protocols complicates the work of EDR solutions that focus on centralized communication patterns.

The primary objective of the Glassworm botnet appears to be the long-term compromise of software development pipelines. Once the malware establishes a foothold, it can exfiltrate environment variables, source code, and cloud credentials. This information is then used to further the Supply Chain Attack by injecting malicious code into the victim’s own software products, potentially affecting thousands of downstream users.

Detecting Glassworm Malware in Developer Environments

Detecting this specific threat requires a shift from domain-based filtering to behavioral analysis. Security teams should prioritize identifying the execution of unauthorized scripts during the npm install process. Glassworm’s reliance on the Solana blockchain and BitTorrent DHT means that IoC lists based on traditional URLs are often insufficient for identifying active infections.

To improve detection, defenders should look for:

• Unexpected BitTorrent traffic (UDP port 6881 or DHT-related packets) originating from developer workstations.
• Frequent API calls to Solana RPC nodes from non-development related processes or scripts.
• Unsigned binaries or hidden scripts executing from temporary directories immediately following package installation.
• Spikes in DNS requests for common blockchain gateway services.

Actionable Recommendations and Mitigations

To defend against Glassworm and similar decentralized threats, organizations should implement the following controls:

• Package Manifest Auditing: Use automated tools to scan package.json and lockfiles for typosquatting or known malicious packages before they are integrated into the build pipeline.
• Network Segmentation: Restrict developer workstations from accessing peer-to-peer networks and non-essential blockchain RPC endpoints unless strictly necessary for business functions.
• Endpoint Monitoring: Configure EDR policies to alert on anomalous subprocesses spawned by package managers such as npm, pip, or cargo.
• Credential Rotation: If an infection is suspected, immediately rotate all Git, AWS, and environment-specific secrets associated with the affected workstation to prevent further Lateral Movement.