INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

Police Disrupt Evil Corp's SocGholish Botnet via Global Network

| 2026-06-23 13:51 CRITICAL HIGH MALWARE & BOTNETS STATE-SPONSORED & ESPIONAGE LAW ENFORCEMENT
JSON
Executive Summary
AI-generated
A global law enforcement operation, codenamed Operation Endgame, disrupted SocGholish, a notorious malware framework used by many cybercriminal gangs, including the Russian ransomware gang Evil Corp. The operation, which took place on June 18, 2026, resulted in the seizure of 106 servers and domains tied to SocGholish, as well as the remediation of 14,971 compromised websites primarily hosted on WordPress. Almost every vertical industry has had at least one SocGholish domain query over the past five months, with government, education, banking, healthcare, and non-IT services sectors having the most activity. The malware framework uses traffic distribution systems (TDSs) to redirect unsuspecting visitors from their intended destinations to fake browser updates, which are then used to establish an initial foothold into victim computers and facilitate further targeting with ransomware campaigns and espionage.
Technical Mitigations AI-generated
• Audit (ATT&CK mitigation for Phishing): Perform audits or scans of systems, permissions, insecure software, insecure configurations, etc. • Pre-compromise (ATT&CK mitigation for Botnet): This technique cannot be easily mitigated with preventive controls since it is based on behaviors performed outside of the scope of enterprise defenses and controls.
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
Operation EndgameOperation Endgame DridexDridexFakeUpdatesFakeUpdatesSocGholishSocGholishWastedLockerWastedLockerRansomHubRansomHub
Target & Sectors
BENELUX BENELUX NORTH_AMERICA NORTH_AMERICA DACH DACH educationeducation technologytechnology healthhealth hospitalityhospitality financefinance governmentgovernment
Incident Timeline
‎2026/06/16
Threat actors used SocGholish's framework to target enterprises and public sectors, as highlighted in an Infoblox blog post published on June 16, 2026.
malware SocGholish
According to an Infoblox blog post on SocGholish last week, the framework casts a wide net across enterprises and public sectors.
‎June 18
Threat actors used a malware to establish an initial foothold into victim computers, collectively known as a botnet, for further targeting with ransomware campaigns and espionage.
tactic Ransomware
"The malware establishes an initial foothold into victim computers, collectively known as a botnet, and is then used by threat actors for further targeting with ransomware campaigns and espionage," the FBI Cyber Division said in a post on X on June 18.
tactic Botnet
"The malware establishes an initial foothold into victim computers, collectively known as a botnet, and is then used by threat actors for further targeting with ransomware campaigns and espionage," the FBI Cyber Division said in a post on X on June 18.
tactic Espionage
"The malware establishes an initial foothold into victim computers, collectively known as a botnet, and is then used by threat actors for further targeting with ransomware campaigns and espionage," the FBI Cyber Division said in a post on X on June 18.
attribution FBI Cyber Division
"The malware establishes an initial foothold into victim computers, collectively known as a botnet, and is then used by threat actors for further targeting with ransomware campaigns and espionage," the FBI Cyber Division said in a post on X on June 18.
‎2026/06/23
Threat actors used traffic distribution systems (TDSs) to facilitate the SocGholish botnet, a malware framework that compromised thousands of websites and infected millions of devices.
infrastructure 106 servers
Cybersecurity firms, researchers and officials from the United States, Canada, Germany, the Netherlands and Europol took down 106 servers and remediated nearly 15,000 sites that were infected with the malware.
In the latest installment of the ongoing Operation Endgame , authorities seized 106 servers and many domains tied to SocGholish , a notorious malware framework that has plagued the Internet for nearly a decade as an initial-access broker for ransomware and other threats.
organisation Europol
Cybersecurity firms, researchers and officials from the United States, Canada, Germany, the Netherlands and Europol took down 106 servers and remediated nearly 15,000 sites that were infected with the malware.
organisation DoppelPaymer
It also provided initial access to other ransomware variants, including DoppelPaymer, WastedLoocker, Hades Ransomware, LockBit, RansomHub and others, according to Infoblox , which participated in the takedown.
organisation WastedLoocker
It also provided initial access to other ransomware variants, including DoppelPaymer, WastedLoocker, Hades Ransomware, LockBit, RansomHub and others, according to Infoblox , which participated in the takedown.
organisation LockBit
It also provided initial access to other ransomware variants, including DoppelPaymer, WastedLoocker, Hades Ransomware, LockBit, RansomHub and others, according to Infoblox , which participated in the takedown.
organisation WordPress
The law-enforcement operation also remediated 14,971 websites, primarily hosted on WordPress, that had been compromised by SocGholish operators.
organisation TDS
Affiliate threat actors have also used Keitaro , a commercial TDS frequently abused by cybercriminals, to drive traffic to SocGholish (Keitaro and parent company Apliteni recently cooperated with researchers at Infolox to disrupt abuse of their platform).
The globally coordinated effort targeted SocGholish, multi-stage malware that has compromised websites, redirected users to traffic distribution systems (TDS) and slipped malware into their networks since 2017.
organisation Keitaro
Affiliate threat actors have also used Keitaro , a commercial TDS frequently abused by cybercriminals, to drive traffic to SocGholish (Keitaro and parent company Apliteni recently cooperated with researchers at Infolox to disrupt abuse of their platform).
organisation IAM
For example, Infoblox noted domain-joined systems are valuable to SocGholish because they are likely connected to enterprise identity and management (IAM) environments, which contain valuable login information for users.
organisation Evil Corp.
The botnet, also known as “FakeUpdates,” is linked to the Russian cybercrime group Evil Corp.
organisation TDSs
An international law enforcement operation disrupted a key cog in the cybercrime ecosystem and put a spotlight on the risks to enterprises posed by traffic distribution systems (TDSs).
organisation Novo Nordisk Breach Highlights
Related: Novo Nordisk Breach Highlights Software Development Pipeline Risk From there, TDSs are used to redirect unsuspecting visitors from their intended destinations to the fake browser updates.
financial $100 authorities
The threat actor was sanctioned by the United States in 2019 for its role in developing and distributing the Dridex banking malware, which U.S. authorities said caused more than $100 million in financial losses worldwide.
infrastructure 100 servers
An international law enforcement operation has disrupted a malware network linked to the Russia-based cybercrime group Evil Corp, taking down more than 100 servers and disinfecting nearly 15,000 hacked websites used to spread malicious software.
Tactical Metrics
Metrics
infrastructure
106
Servers
In the latest installment of the ongoing Operation Endgame , authorities seized 106 servers and many domains tied to SocGholish , a notorious malware framework that has plagued the Internet for nearly a decade as an initial-access broker for ransomware and other threats.
Cybersecurity firms, researchers and officials from the United States, Canada, Germany, the Netherlands and Europol took down 106 servers and remediated nearly 15,000 sites that were infected with the malware.
Metrics
infrastructure
100
Servers
An international law enforcement operation has disrupted a malware network linked to the Russia-based cybercrime group Evil Corp, taking down more than 100 servers and disinfecting nearly 15,000 hacked websites used to spread malicious software.
Metrics
financial
100,000,000
Authorities
The threat actor was sanctioned by the United States in 2019 for its role in developing and distributing the Dridex banking malware, which U.S. authorities said caused more than $100 million in financial losses worldwide.
Intelligence Sources
TheRecord 2026-06-19
Dark Reading 2026-06-23
CyberScoop 2026-06-18