← All threat actors
GlassWormmalware / toolS9010 ↗
GlassWorm is a worm that propagated through supply chain attacks by compromising repository credentials from victim environments and having malicious payloads added to those compromised accounts for distribution to victims across the various development ecosystems.
Reports / IOCs (VT)
163 reports · 193 IOCs
Reported activity
2025 – 2026
ATT&CK techniques in reports
- T1204 User Execution4
- T1027 Obfuscated Files or Information3
- T1105 Ingress Tool Transfer3
- T1059.007 JavaScript3
- T1102.001 Dead Drop Resolver3
- T1059 Command and Scripting Interpreter2
- T1059.003 Windows Command Shell2
- T1027.013 Encrypted/Encoded File2
- T1195.001 Compromise Software Dependencies and Development Tools2
- T1480 Execution Guardrails2
- T1071 Application Layer Protocol1
- T1102 Web Service1
- T1195 Supply Chain Compromise1
- T1005 Data from Local System1
- T1041 Exfiltration Over C2 Channel1
- T1059.001 PowerShell1
- T1059.004 Unix Shell1
- T1071.001 Web Protocols1
- T1082 System Information Discovery1
- T1190 Exploit Public-Facing Application1