About this episode

Tillmann Werner discusses the complexities and strategies behind CrowdStrike's takeover of the Glassworm botnet.

He’s back, and he’s ready to talk botnet takeovers.Tillmann Werner, VP of Intelligence Production at CrowdStrike, returns to the podcast to discuss CrowdStrike’s coordinated takeover of the Glassworm botnet. Glassworm was a global threat targeting software developers through the open-source supply chain. This infection vector stood out — open-source ecosystems are based on trust, and adversaries are learning they can reach a vast pool of victims by compromising the supply chain. Some open-source libraries get 100 million downloads per week.Glassworm was described as an “unkillable” botnet. Resilience was built into its design, which relied on four different command-and-control channels. This made the takeover complicated because a botnet can’t be taken over until all command-and-control mechanisms are suppressed.“Once it’s down, you gotta make sure it’s down,” said Adam, who calls Tillmann the “bot slayer.”In this episode, they get into the details: what Glassworm was after, how its unknown operators strengthened its infrastructure, and the planning and execution behind the takeover. Tillmann and his team facilitated the process by conducting extensive technical analysis…

More episodes of Adversary Universe Podcast

• SaaS Security Threats to Worry About, with Salesforce’s Kelly McCracken · July 9, 2026 · 37 min

Explore listener stats, chart rankings, contacts and more on the Adversary Universe Podcast podcast page.