OSV false positives, Crowdstrike takedown of Glassworm infra, and MSFT nukes a researcher

This week Jenn and Paul covered: - **OSV false positives from AWS Inspector:** AWS's automated malware detection pipeline submitted 157 false positive entries to osv.dev. The entries were merged before anyone caught the errors. When the community began pointing out that some of those "false positives" were actually real malware, AWS started adding some back, making this a mess on both ends. AppSec vendors piled on publicly despite relying on OSV as their primary detection source without contributing to it. Paul publicly thanks Chi Tran's team at AWS Inspector for their contributions overall. - **CrowdStrike, Google, and Shadowserver take down Glassworm C2 (including the botnet vs. worm distinction):** The operation targeted four infrastructure components: Solana blockchain dead drops, BitTorrent DHT, Google Calendar abuse, and commercial VPS servers. The legal and technical basis for the takedown is unclear and CrowdStrike declined to comment on specifics. Paul explains how blockchain memo fields work as dead drops and how multi-stage attack chains evolve. As part of the discussion, Paul clarifies the technical difference between a botnet (centrally orchestrated persistent access across many machines) and a worm (self-replicating), and ties it to how both Glassworm and DPRK/PolinRider operate. - **MSRC, Nightmare Eclipse, and the state of coordinated disclosure:** Researcher Nightmare Eclipse published six unpatched Windows zero-days (RedSun, UnDefend, BlueHammer, YellowKey, GreenPlasma, MiniPlasma) after a breakdown in MSRC's handling of their disclosures. Microsoft's claim that no prior notice was given is contested. Nightmare Eclipse says MSRC knew BlueHammer was coming. Microsoft's MSRC blog post named all six vulnerabilities, invoked its Digital Crimes Unit, and never acknowledged Nightmare Eclipse's claim that Microsoft deleted the account they used to report bugs and paid them nothing. The MSRC post instead triggered a flood of other researchers sharing similar experiences: Gabriel Landau reported MSRC agreed to issue a CVE in exchange for an extended embargo, then patched silently and broke that agreement. Rootsecdev reported a five-month wait followed by a "doesn't meet the bar for servicing" response, while Microsoft silently fixed it anyway. GitHub then banned Nightmare Eclipse's account; GitLab followed suit days later. Paul and Jenn note this reflects a broader, documented pattern of MSRC underinvesting in researcher relationships, not an isolated incident. - **Using GitHub as a forward-hunting collection source:** Paul and Jenn co-authored a guide with Feedly based on the hunting technique Paul has used to discover campaigns like PolinRider. Workshop may be submitted to DEF CON Adversary Village. **Episode Resources:** - GitHub PR: OSV false positive withdrawals: AWS Inspector PR #1276 - Blog: CrowdStrike: Inside the Takedown of a Developer-Targeting Botnet - Blog: Four Arms, One Monster — GlassWorm Invades GitHub, NPM, Open VSX and VS Code - OpenSourceMalware threat reports for Glassworm - X post: International Cyber Digest: Microsoft's response to Nightmare-Eclipse zero-day disclosures - Blog: MSRC: A Shared Responsibility — Protecting Customers Through Coordinated Vulnerability Disclosure - Guide: How to Collect Intelligence from GitHub on Open Source Malware