Netskope Threat Labs

GlassWorm

ATP Sandbox Adv. HeuristicsAV

Description

GlassWorm is a worm that spreads through network shares and browser and development tool extensions while providing backdoor access to infected systems. It hides malicious logic in ways that evade casual inspection, including invisible code paths, and it can steal credentials, hijack accounts, and deploy additional payloads on compromised machines. Its blend of worm propagation and supply chain style distribution makes it a notable threat to developer and enterprise environments alike.

Stats

First seen
January 2026
Last seen
October 2026

MITRE ATT&CK techniques

36 techniques across 9 tactics.

TA0001 Initial Access

  • T1195Supply Chain Compromise
    • T1195.001Compromise Software Dependencies and Development Tools

TA0002 Execution

TA0003 Persistence

  • T1543Create or Modify System Process
  • T1547Boot or Logon Autostart Execution
  • T1554Compromise Host Software Binary

TA0005 Stealth

TA0006 Credential Access

TA0007 Discovery

  • T1082System Information Discovery
  • T1124System Time Discovery
  • T1217Browser Information Discovery
  • T1518Software Discovery
  • T1614System Location Discovery

TA0009 Collection

TA0011 Command and Control

TA0040 Impact

Alert name variants

Alert Name
Generic.JS.GlassWorm.B.0545ED0A
Generic.JS.GlassWorm.B.055F5855
Generic.JS.GlassWorm.B.07EB88AD
Generic.JS.GlassWorm.B.0D1FD0A4
Generic.JS.GlassWorm.B.1ACDA93E
Generic.JS.GlassWorm.B.1CC1387F
Generic.JS.GlassWorm.B.2254E46F
Generic.JS.GlassWorm.B.25398F0D
Generic.JS.GlassWorm.B.27DBD89D
Generic.JS.GlassWorm.B.302FB7AF

Related blogs

Related families

BeaverTailInvisibleFerretRedLine StealerInvisiMoleMetamorfo

References