He’s back, and he’s ready to talk botnet takeovers. Tillmann Werner, VP of Intelligence Production at CrowdStrike, returns to the podcast to discuss CrowdStrike’s coordinated takeover of the Glassworm botnet. Glassworm was a global threat targeting software developers through the open-source supply chain. This infection vector stood out — open-source ecosystems are based on trust, and adversaries are learning they can reach a vast pool of victims by compromising the supply chain. Some open-source libraries get 100 million downloads per week. Glassworm was described as an “unkillable” botnet. Resilience was built into its design, which relied on four different command-and-control channels. This made the takeover complicated because a botnet can’t be taken over until all command-and-control mechanisms are suppressed. “Once it’s down, you gotta make sure it’s down,” said Adam, who calls Tillmann the “bot slayer.” In this episode, they get into the details: what Glassworm was after, how its unknown operators strengthened its infrastructure, and the planning and execution behind the takeover. Tillmann and his team facilitated the process by conducting extensive technical analysis, understanding Glassworm’s evolution, and spotting the opportunity to disrupt it. They worked with partners across the private and public sectors, as well as internally at CrowdStrike, to do it safely and avoid disrupting critical systems. Come for the behind-the-scenes details, and stay for the debate around baking the perfect pizza in this episode of the Adversary Universe podcast. Learn more in our blog: https://www.crowdstrike.com/en-us/blog/inside-crowdstrike-takedown-of-a-developer-targeting-botnet/.

The technology sector is the most targeted in the world by eCrime and state-sponsored threat actors. Between April 1, 2025, and March 31, 2026, China-nexus adversaries drove more than 58% of state-sponsored interactive intrusions against the sector, creating the greatest intelligence collection threat to tech companies. These threat actors are escalating espionage against tech businesses to steal the AI capabilities and intellectual property they can’t build fast enough on their own. Adversaries such as MURKY PANDA, MUSTANG PANDA, OVERCAST PANDA, SUNRISE PANDA, and WARP PANDA targeted the tech sector more than any other industry. And China isn’t alone — Democratic People’s Republic of Korea (DPRK) adversaries also have their sights set on tech. The CrowdStrike 2026 Technology Threat Landscape Report, now live, sheds light on how nation-state and eCrime adversaries are targeting this critical industry. From FAMOUS CHOLLIMA’s IT infiltration campaigns to eCrime adversaries accelerating extortion, there is a broad range of threats that tech organizations must prepare for. Modern tech companies are creating the world’s most valuable and targeted assets, and their cutting-edge innovations represent both competitive advantage and greater risk. Tune in to learn the report’s key takeaways and hear Adam and Cristian dive into the report’s findings.

The CrowdStrike 2026 Financial Services Threat Landscape report is now live! Adam and Cristian are here to break down the trends and techniques affecting an industry that has become a major target for adversaries. Financial services is the fourth most-targeted industry as of Q1 2026 and accounts for 12% of all observed adversary activity. eCrime adversaries target the industry for financial gain. MUTANT SPIDER, the most active eCrime threat in the past 12 months, is tied to several intrusions in which they sell access to ransomware groups. The Democratic People’s Republic of Korea set its sights on cryptocurrency and fintech entities to steal funds for its military programs. While financial gain may seem the obvious goal in targeting financial services, it’s not the only one. Nation-state adversaries in China, Iran, and Russia launched operations against the sector for intelligence collection. Hacktivists conducted DDoS campaigns and data breach operations, primarily driven by ideological conflicts. Even if you don’t work in the financial services sector, you most likely work with it — consumer banks, credit card companies, insurers, payment processors, and related businesses are all part of everyday business and personal life. Tune in to hear which adversaries are targeting them and why, which regions are in the crosshairs, and how companies should defend themselves. And stick around to hear about Adam’s foray into ice cream cakes.