000 SocGholish‑Infected Sites Tied to Evil Corp

Overview In a major international cybercrime takedown, law enforcement agencies have cleaned nearly 15,000 WordPress websites infected with the SocGholish malware downloader, a JavaScript‑based tool linked to the notorious Evil Corp Russian cybercrime group. The operation — code‑named Operation Endgame — marks a significant step toward disrupting one of the most persistent infection chains in modern cybercrime. Operation Endgame in Action Authorities from the Netherlands (NHCTU), Canada (RCMP), the United States (FBI), and Germany (BKA) worked with Europol and Eurojust to remove malware and backdoors from 14,971 compromised WordPress sites and take 106 servers and domains offline. Agency Role in Operation NHCTU (Netherlands) Led malware removal and site restoration. FBI (United States) Coordinated server takedowns and evidence collection. RCMP (Canada) Assisted in cross‑border data tracking. BKA (Germany) Executed domain seizures and infrastructure shutdowns. Dutch police also advised website owners to change credentials, enable MFA, delete unknown WordPress accounts, and keep sites updated to prevent reinfection. “With these actions we deprive cybercriminals of access to infected systems and limit the spread of malware,” said Maikel Rollman of the Netherlands’ National High Tech Crime Unit. Understanding SocGholish SocGholish — also known as FakeUpdates or GhoLoader — has been active since 2017. It hijacks legitimate websites and tricks visitors into downloading malicious payloads disguised as browser updates. Attack Flow: SocGholish has been used to deliver malware families such as Dridex, Doppelpaymer, Empire, Koadic, Chtonic, and Azorult — all linked to Evil Corp’s criminal operations. Evil Corp Connection Evil Corp has been active since 2007 and is associated with the Zeus and Dridex malware families, as well as ransomware operations like WastedLocker, Hades, Macaw Locker, and Phoenix CryptoLocker. By cleaning SocGholish‑infected sites, Operation Endgame has effectively cut off a key distribution channel used by Evil Corp to spread its payloads and launch ransomware attacks against businesses and critical infrastructure. Preventive Measures for Website Owners Law enforcement recommendations serve as a blueprint for WordPress security hardening: […]