International 'Operation Endgame' Dismantles SocGholish Botnet Infrastructure Linked to Evil Corp
Operation Endgame: Global Law Enforcement Disrupts SocGholish, Cleans 15,000 Infected Websites
Related Entities(initial)
Threat Actors
Organizations
Products & Tech
Other
Full Report(when first published)
Executive Summary
An international law enforcement effort, part of the broader Operation Endgame, has successfully disrupted the infrastructure of the SocGholish malware network. The operation, a collaboration between authorities in the U.S., Germany, the Netherlands, and Canada with support from Europol, resulted in the takedown of 106 command-and-control (C&C) servers. Additionally, the coalition cleaned malware from 14,971 compromised WordPress websites that were being used to distribute the malware. SocGholish is a major initial access broker (IAB) linked to the Russian cybercrime group Evil Corp (also known as Indrik Spider). The disruption strikes a significant blow against a key facilitator of ransomware and other high-impact cyberattacks.
Incident Timeline
- 2017: SocGholish malware first observed in the wild.
- Ongoing: The group compromises thousands of websites, primarily running WordPress, and uses them as a distribution platform.
- June 18-19, 2026: As part of Operation Endgame, law enforcement agencies seize 106 C&C servers and domains used by SocGholish.
- June 19, 2026: Authorities announce the successful disruption and the cleaning of nearly 15,000 infected websites.
Response Actions
The coordinated operation involved several key actions:
- Infrastructure Takedown: Law enforcement agencies in multiple countries worked together to seize or sinkhole 106 servers that formed the backbone of the SocGholish C&C network. This action severed the connection between the infected websites and the attackers, preventing them from issuing new commands or deploying further payloads.
- Victim Notification and Remediation: The operation identified 14,971 compromised WordPress sites. Law enforcement, in conjunction with cybersecurity partners, removed the malicious JavaScript and backdoors from these sites. The owners of the affected websites were notified and provided with guidance to secure their platforms, including changing credentials and applying updates.
- Intelligence Gathering: The seized infrastructure will be analyzed to gather intelligence on the operators, identify more victims, and understand the full scope of the operation.
Technical Findings
SocGholish, also known as FakeUpdates, operates using a drive-by compromise model (T1189 - Drive-by Compromise). The attack flow is as follows:
- Website Compromise: The attackers exploit vulnerabilities in content management systems (CMS) like WordPress, Joomla, and Drupal to inject malicious JavaScript into legitimate websites.
- Visitor Profiling: When a user visits an infected site, the malicious script executes in their browser. It profiles the visitor's system to determine if it is a suitable target (e.g., not a security researcher, within a specific geographic region).
- Social Engineering: If the visitor is deemed a target, the script displays a convincing but fake browser update prompt (e.g., for Chrome or Firefox). This lure tricks the user into downloading and executing a malicious file, which is often a ZIP archive containing a JScript loader.
- Payload Delivery: The initial loader, often referred to as Gholoader, establishes a foothold and communicates with the C&C server. It then downloads and executes second-stage payloads. SocGholish is known to be a delivery mechanism for a wide variety of malware, including:
This makes SocGholish a critical link in the cybercrime supply chain, providing the initial access needed for some of the world's most damaging ransomware attacks.
Lessons Learned
- Effectiveness of International Cooperation: This operation highlights the success of coordinated, public-private partnerships in combating global cybercrime infrastructure.
- The Importance of IABs: The focus on disrupting an Initial Access Broker like SocGholish is a strategic move that has a cascading effect, disrupting the operations of numerous other cybercrime groups that rely on them.
- CMS Security is Critical: The large number of compromised WordPress sites underscores the ongoing challenge of securing popular web platforms. Unpatched plugins, weak credentials, and lack of monitoring remain common entry points.
Mitigation Recommendations
For website owners:
- Patch Management: Keep your CMS (WordPress, Joomla, etc.) and all plugins/themes updated to the latest versions. This is a form of M1051 - Update Software.
- Credential Security: Use strong, unique passwords for all administrative accounts and enable Multi-factor Authentication (M1032).
- File Integrity Monitoring: Use security plugins or services to monitor for unauthorized changes to your website's files.
For end-users and organizations:
- User Training: Train users to be suspicious of unsolicited browser update prompts and to only download updates from official sources. This aligns with M1017 - User Training.
- Ad Blockers/Script Blockers: Use web filtering or script-blocking browser extensions to prevent malicious JavaScript from executing.
- Execution Prevention: Configure systems to block the execution of JScript files (
.js,.jse) by default.
Timeline of Events
Article Updates
June 24, 2026
Severity increasedOperation Endgame expanded to disrupt Amadey and StealC, seizing EUR 41M in crypto and 27M credentials, with 326 servers taken down.
The global 'Operation Endgame' has significantly expanded its scope beyond SocGholish, now also disrupting the infrastructure of Amadey and StealC malware networks. This broader action involved the takedown of 326 servers and 142 domains, a substantial increase from previously reported figures. Law enforcement also seized over EUR 41 million in criminal crypto assets and recovered 27 million stolen credentials. The operation now includes agencies from six countries, with private sector partners like Microsoft playing a key role, notably using the RICO Act to dismantle Amadey and StealC infrastructure. This represents a much larger blow to the cybercrime ecosystem.
June 24, 2026
Severity decreasedOperation Endgame expanded to disrupt Amadey and StealC, taking down over 300 servers, seizing EUR 41M in crypto, and recovering 27M credentials.
The international 'Operation Endgame' has expanded its reported success, now confirming the disruption of not only SocGholish but also the Amadey botnet and StealC infostealer networks. The updated figures reveal a takedown of 326 servers and 142 domains, a significant increase from the initial report. Law enforcement also seized over EUR 41 million in criminal crypto assets and recovered 27 million stolen credentials. Microsoft played a key role, utilizing the RICO Act to dismantle Amadey and StealC infrastructure, highlighting a novel legal approach in cybercrime enforcement. This broader action further mitigates the threat from these initial access brokers.
Update Sources:
Sources & References(when first published)
Article Author
Jason Gomes
• Cybersecurity PractitionerCybersecurity professional with over 10 years of specialized experience in security operations, threat intelligence, incident response, and security automation. Expertise spans SOAR/XSOAR orchestration, threat intelligence platforms, SIEM/UEBA analytics, and building cyber fusion centers. Background includes technical enablement, solution architecture for enterprise and government clients, and implementing security automation workflows across IR, TIP, and SOC use cases.
Editorial Standards & Analyst Review
CyberNetSec.io uses automation to assist source monitoring, deduplication, observable extraction, and structured intelligence generation. Published analysis follows human-defined editorial standards and adds defensive context including MITRE ATT&CK, D3FEND, STIX, and Sigma where applicable. Read our editorial policy.
Tags
📢 Share This Article
Help others stay informed about cybersecurity threats
🎯 MITRE ATT&CK Mapped
Every tactic, technique, and sub-technique used in this threat has been identified and mapped to the MITRE ATT&CK framework for consistent, actionable threat language.
🧠 Enriched & Analyzed
Observables and indicators of compromise (IOCs) have been extracted and cataloged. Risk has been assessed and correlated with known threat actors and historical campaigns.
🛡️ Actionable Guidance
Detection rules, incident response steps, and D3FEND-aligned mitigation strategies are included so your team can act on this intelligence immediately.
🔗 STIX Visualizer
Structured threat data is packaged as a STIX 2.1 bundle and can be visualized as an interactive graph — relationships between actors, malware, techniques, and indicators.
⚡ Sigma Generator
Sigma detection rules are derived from the threat techniques in this article and can be converted for deployment across any major SIEM or EDR platform.