GlassWorm
Software · ATTACK:enterprise:S9010
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:S9010",
"title": "GlassWorm",
"type": "Software",
"source_url": "https://attack.mitre.org/software/S9010",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "malware--809bc57b-4d4c-43de-b698-448334ed8185",
"external_id": "S9010",
"domain": "enterprise",
"created": "2026-04-10T16:59:14.138Z",
"modified": "2026-04-24T02:39:02.116Z",
"version": "1.0",
"aliases": [
],
"tactics": [
],
"source_references": [
{
"source_name": "Koi Glassworm New Tricks December 2025",
"url": "https://www.koi.ai/blog/glassworm-goes-mac-fresh-infrastructure-new-tricks"
},
{
"source_name": "Koi Glassworm Extensions November 2025",
"url": "https://www.koi.ai/blog/glassworm-returns-new-wave-openvsx-malware-expose-attacker-infrastructure"
},
{
"source_name": "Koi Glassworm InvisibleCode October 2025",
"url": "https://www.koi.ai/blog/glassworm-first-self-propagating-worm-using-invisible-code-hits-openvsx-marketplace"
},
{
"source_name": "Aikido GlassWorm October 2025",
"url": "https://www.aikido.dev/blog/the-return-of-the-invisible-threat-hidden-pua-unicode-hits-github-repositorties"
},
{
"source_name": "Socket GlassWorm January 2026",
"url": "https://socket.dev/blog/glassworm-loader-hits-open-vsx-via-suspected-developer-account-compromise"
},
{
"source_name": "Koi GlassWorm Rust December 2025",
"url": "https://www.koi.ai/blog/glassworm-goes-native-same-infrastructure-hardened-delivery"
}
]
}Explicit source assertions (36)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:S9010 → uses → ATTACK:enterprise:T1213.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--04d9eeb2-158d-49d4-a100-555f6cf341ea
Socket GlassWorm January 2026ATTACK:enterprise:S9010 → uses → ATTACK:enterprise:T1571
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--14787d55-5815-43ee-ae4b-a31334ceed97
Koi Glassworm InvisibleCode October 2025ATTACK:enterprise:S9010 → uses → ATTACK:enterprise:T1480
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--19f69da1-f2c1-4228-867b-e0d07a123681
Socket GlassWorm January 2026ATTACK:enterprise:S9010 → uses → ATTACK:enterprise:T1124
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1b6ef810-3d1b-400e-88ea-171618266f54
Socket GlassWorm January 2026ATTACK:enterprise:S9010 → uses → ATTACK:enterprise:T1560.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--20a447db-9606-4f4a-a0e8-57167ba4535e
Socket GlassWorm January 2026ATTACK:enterprise:S9010 → uses → ATTACK:enterprise:T1071.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--21590c70-e34e-47be-a6e7-8f5b18eee229
Koi Glassworm InvisibleCode October 2025ATTACK:enterprise:S9010 → uses → ATTACK:enterprise:T1543.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--22234127-7175-4ace-a2eb-535849e81f8d
Koi Glassworm New Tricks December 2025 · Socket GlassWorm January 2026ATTACK:enterprise:S9010 → uses → ATTACK:enterprise:T1090.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--29184298-9a17-4def-8ad8-10381b4bde89
Koi Glassworm InvisibleCode October 2025ATTACK:enterprise:S9010 → uses → ATTACK:enterprise:T1602.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--34a3a837-87e0-4ee7-a268-354a79f69927
Koi Glassworm New Tricks December 2025 · Socket GlassWorm January 2026ATTACK:enterprise:S9010 → uses → ATTACK:enterprise:T1555.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--354b2d56-9b68-4481-b05d-b72a347bb4a7
Koi Glassworm New Tricks December 2025 · Socket GlassWorm January 2026ATTACK:enterprise:S9010 → uses → ATTACK:enterprise:T1140
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--397cb08d-0466-4f92-8317-73da637dcded
Koi Glassworm New Tricks December 2025 · Koi Glassworm InvisibleCode October 2025 · Socket GlassWorm January 2026ATTACK:enterprise:S9010 → uses → ATTACK:enterprise:T1678
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--416a4073-3236-461c-ab0f-6c1e50d0a9f9
Koi Glassworm New Tricks December 2025ATTACK:enterprise:S9010 → uses → ATTACK:enterprise:T1539
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--42d78c28-8a26-4cac-88bb-93e35d5226e4
Koi Glassworm New Tricks December 2025 · Socket GlassWorm January 2026ATTACK:enterprise:S9010 → uses → ATTACK:enterprise:T1102.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--44d29b3e-75ee-48b8-977c-5e231c49e84a
Koi Glassworm New Tricks December 2025 · Koi Glassworm Extensions November 2025 · Koi Glassworm InvisibleCode October 2025 · Aikido GlassWorm October 2025 · Socket GlassWorm January 2026 · Koi GlassWorm Rust December 2025ATTACK:enterprise:S9010 → uses → ATTACK:enterprise:T1213.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--45e23658-bbbb-46ff-a1f3-ad370c2a3ad5
Koi Glassworm New Tricks December 2025 · Koi Glassworm InvisibleCode October 2025 · Socket GlassWorm January 2026ATTACK:enterprise:S9010 → uses → ATTACK:enterprise:T1555.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4e16de60-84f8-47c8-a069-a7af5178b13d
Koi Glassworm New Tricks December 2025 · Socket GlassWorm January 2026ATTACK:enterprise:S9010 → uses → ATTACK:enterprise:T1005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--51c94403-d475-4bf0-8512-877993e17888
Socket GlassWorm January 2026ATTACK:enterprise:S9010 → uses → ATTACK:enterprise:T1564.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5b874a36-35e7-46da-ad9a-209e8310de52
Koi Glassworm InvisibleCode October 2025ATTACK:enterprise:S9010 → uses → ATTACK:enterprise:T1027.013
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5cbc2db4-fe47-4d6c-911a-d406cc06c519
Koi Glassworm New Tricks December 2025 · Koi Glassworm InvisibleCode October 2025 · Socket GlassWorm January 2026 · Koi GlassWorm Rust December 2025ATTACK:enterprise:S9010 → uses → ATTACK:enterprise:T1657
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5d8af397-e47d-4665-b8f7-19f81fd646f9
Koi Glassworm New Tricks December 2025 · Koi Glassworm InvisibleCode October 2025 · Socket GlassWorm January 2026ATTACK:enterprise:S9010 → uses → ATTACK:enterprise:T1036
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--61f793e5-6b95-46db-a54d-74745747a3d5
Aikido GlassWorm October 2025 · Koi GlassWorm Rust December 2025ATTACK:enterprise:S9010 → uses → ATTACK:enterprise:T1195.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--633c4102-be49-42dd-bf73-2f79c8f0eaf5
Koi Glassworm InvisibleCode October 2025 · Aikido GlassWorm October 2025 · Socket GlassWorm January 2026ATTACK:enterprise:S9010 → uses → ATTACK:enterprise:T1074.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--66773d13-7e97-493f-a1b6-9484c52cc6a1
Koi Glassworm New Tricks December 2025 · Socket GlassWorm January 2026ATTACK:enterprise:S9010 → uses → ATTACK:enterprise:T1547.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6e18aefd-85d3-432e-9ebb-3dde28c4bc6c
Koi Glassworm InvisibleCode October 2025ATTACK:enterprise:S9010 → uses → ATTACK:enterprise:T1027.018
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--796b5e76-298f-49e3-b93e-53ecfbb2a1ce
Koi Glassworm New Tricks December 2025 · Koi Glassworm InvisibleCode October 2025 · Aikido GlassWorm October 2025ATTACK:enterprise:S9010 → uses → ATTACK:enterprise:T1565.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9260c5d3-a816-4ab9-9582-0b2fe95a9261
Koi Glassworm New Tricks December 2025ATTACK:enterprise:S9010 → uses → ATTACK:enterprise:T1614
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9d4c9cb8-d5fb-4679-8b38-fab55f237963
Socket GlassWorm January 2026ATTACK:enterprise:S9010 → uses → ATTACK:enterprise:T1059.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9f2a884d-0974-4080-80a1-13a29a7f25c7
Koi Glassworm New Tricks December 2025ATTACK:enterprise:S9010 → uses → ATTACK:enterprise:T1059.007
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a7c7be1a-68a4-408b-94c8-3bbebeed618d
Koi Glassworm New Tricks December 2025 · Koi Glassworm Extensions November 2025 · Koi Glassworm InvisibleCode October 2025 · Aikido GlassWorm October 2025 · Socket GlassWorm January 2026ATTACK:enterprise:S9010 → uses → ATTACK:enterprise:T1614.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ab0a634d-8b55-4f66-b800-e4d48ebcd7cc
Socket GlassWorm January 2026ATTACK:enterprise:S9010 → uses → ATTACK:enterprise:T1217
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ae256211-86ed-4587-adcf-3311aa8505be
Socket GlassWorm January 2026ATTACK:enterprise:S9010 → uses → ATTACK:enterprise:T1008
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--af0ba134-74c9-4256-a48d-6911e98cf235
Koi Glassworm InvisibleCode October 2025 · Koi GlassWorm Rust December 2025ATTACK:enterprise:S9010 → uses → ATTACK:enterprise:T1082
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b5076cf3-ccd5-4dd7-895b-abf79eddf63f
Socket GlassWorm January 2026 · Koi GlassWorm Rust December 2025ATTACK:enterprise:S9010 → uses → ATTACK:enterprise:T1554
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c434336b-336d-490f-bf9a-5e0d259d6d5c
Koi Glassworm New Tricks December 2025ATTACK:enterprise:S9010 → uses → ATTACK:enterprise:T1518
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--cb72e7c8-23a4-40d8-916e-99a18db9039c
Koi Glassworm New Tricks December 2025ATTACK:enterprise:S9010 → uses → ATTACK:enterprise:T1105
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d8613097-6ef1-4b84-8641-0951cab8376f
Koi Glassworm New Tricks December 2025 · Koi Glassworm Extensions November 2025 · Socket GlassWorm January 2026 · Koi GlassWorm Rust December 2025