GlassWorm C2 Activity via Solana Blockchain

Ramzi Zelfani@rzelfani

•updated Nov 17, 2025•41•4•316

Detects network traffic to Solana RPC endpoints containing the wallet address associated with the GlassWorm malware. GlassWorm uses the Solana blockchain as a resilient C2 mechanism by querying for transactions from an attacker-controlled wallet.