MITRE ATT&CKsoftware (malware)

S9010 GlassWorm

Published 2026-04-10 Modified 2026-04-24 Official page ↗
Domain
enterprise
Platforms
macOS, Windows
Version
1.0
Created
2026-04-10

Description

GlassWorm is a worm that propagated through supply chain attacks by compromising repository credentials from victim environments and having malicious payloads added to those compromised accounts for distribution to victims across the various development ecosystems. GlassWorm has numerous variants, including Rust binaries, encrypted JavaScript and a variant leveraging invisible Unicode characters that made reverse engineering difficult. GlassWorm has employed a unique command and control (C2) methodology using Solana blockchain. GlassWorm was first reported in October 2025.

Related

Uses · MITRE ATT&CK (36)

  • T1027.018 Invisible Unicode sub-technique
  • T1678 Delay Execution technique
  • T1213.006 Databases sub-technique
  • T1027.013 Encrypted/Encoded File sub-technique
  • T1657 Financial Theft technique
  • T1614.001 System Language Discovery sub-technique
  • T1213.003 Code Repositories sub-technique
  • T1614 System Location Discovery technique
  • T1602.002 Network Device Configuration Dump sub-technique
  • T1059.007 JavaScript sub-technique
  • T1071.001 Web Protocols sub-technique
  • T1090.001 Internal Proxy sub-technique
  • T1102.001 Dead Drop Resolver sub-technique
  • T1571 Non-Standard Port technique
  • T1074.001 Local Data Staging sub-technique
  • T1564.003 Hidden Window sub-technique
  • T1195.001 Compromise Software Dependencies and Development Tools sub-technique
  • T1059.002 AppleScript sub-technique
  • T1565.002 Transmitted Data Manipulation sub-technique
  • T1560.001 Archive via Utility sub-technique
  • T1555.001 Keychain sub-technique
  • T1555.003 Credentials from Web Browsers sub-technique
  • T1554 Compromise Host Software Binary technique
  • T1547.001 Registry Run Keys / Startup Folder sub-technique
  • T1543.001 Launch Agent sub-technique
  • T1539 Steal Web Session Cookie technique
  • T1518 Software Discovery technique
  • T1480 Execution Guardrails technique
  • T1217 Browser Information Discovery technique
  • T1140 Deobfuscate/Decode Files or Information technique
Show all 36 ›

References