Operation Endgame Disrupts SocGholish Fake-Update Infrastructure
Summary
Operation Endgame took down 106 servers and domains and remediated 14,971 compromised WordPress sites tied to SocGholish. Infoblox telemetry found widespread exposure, but few customer networks showed signs of reaching the malware’s later stages.
Key points
- The multinational operation disrupted SocGholish, a fake-browser-update framework used by TA569 to gain initial access for other cybercriminals, including EvilCorp.
- Authorities and industry partners took down 106 servers and domains and remediated 14,971 compromised WordPress websites.
- SocGholish injects fake update prompts into compromised sites, then uses a JScript stager to contact command-and-control infrastructure and deliver follow-on malware.
- The framework uses traffic filtering and rapidly rotated, shadowed domains, complicating detection and reducing the effectiveness of static blocklists.
- From January through May 2026, more than 54% of Infoblox Threat Defense cloud customer networks attempted to resolve SocGholish tier-one domains; this indicates exposure, not confirmed device compromise.
- Only a handful of customer networks queried tier-two hostnames, suggesting few observed cases progressed to the stager stage, though some affected organizations were in government, hospitality, and critical infrastructure.
- Infoblox expects sightings to decline after the disruption but says defenders should watch for TA569 and its traffic suppliers to rebuild or shift infrastructure.
Article Details
- Event Type
- Multinational law-enforcement action, with private-industry partners, disrupting SocGholish infrastructure as part of Operation Endgame.
- Impact
- The action took down 106 servers and domains and remediated 14,971 compromised WordPress websites, according to the article. Infoblox reports that more than 54% of its Threat Defense cloud customer networks attempted to resolve SocGholish tier-one domains during the first five months of 2026, while only a small number appeared to progress to on-device execution. The article says the observed data reflects attempted connections and does not establish successful compromise for most customers.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| HOSTNAME | api-app[.]uppercrafteroom[.]com | SocGholish tier-one hostname listed as malicious infrastructure observed in customer networks. |
| HOSTNAME | app-front[.]anmaradigital[.]com | SocGholish tier-one hostname listed as malicious infrastructure observed in customer networks. |
| HOSTNAME | billing[.]roofnrack[.]us | SocGholish tier-one hostname listed as malicious infrastructure observed in customer networks. |
| HOSTNAME | content[.]garretttrails[.]org | SocGholish tier-one hostname listed as malicious infrastructure observed in customer networks. |
| HOSTNAME | devel[.]asurans[.]com | SocGholish tier-one hostname listed as malicious infrastructure observed in customer networks. |
| HOSTNAME | pa-portal[.]benningtonspringsmhp[.]com | SocGholish tier-one hostname listed as malicious infrastructure observed in customer networks. |
| HOSTNAME | platform[.]exathomeswebuyarizona[.]com | SocGholish tier-one hostname listed as malicious infrastructure observed in customer networks. |
| HOSTNAME | promo[.]summat10n[.]org | SocGholish tier-one hostname listed as malicious infrastructure observed in customer networks. |
| HOSTNAME | samples[.]addisgraphix[.]com | SocGholish tier-one hostname listed as malicious infrastructure observed in customer networks. |
| HOSTNAME | shop[.]steadycompanion[.]com | SocGholish tier-one hostname listed as malicious infrastructure observed in customer networks. |
| HOSTNAME | storehouse[.]beautysupplysalonllc[.]com | SocGholish tier-one hostname listed as malicious infrastructure observed in customer networks. |
| HOSTNAME | trademark[.]iglesiaelarca[.]com | SocGholish tier-one hostname listed as malicious infrastructure observed in customer networks. |
People
Threat Actors
EvilCorpCybercrime conglomerate described as using SocGholish to obtain initial access.Gold PreludeName used to track TA569.Mustard TempestName used to track TA569.TA2726Named as an affiliate that sold traffic to the SocGholish framework.TA569Operates the SocGholish framework and is described as an initial access broker.UNC1543Name used to track TA569.UNC2165Mandiant's moniker for EvilCorp, which the article says obtained initial access almost exclusively from TA569's SocGholish.
Malware
BumbleBee“seasons” of Operation Endgame focused on known malware families such as IcedID, Smokeloader, Pikabot, Bumblebee, QakBot, DanaBot, TrickBot, and, most recently in November 2025, the Rhadamanthys infostealer, VenomRAT,DanabotEndgame focused on known malware families such as IcedID, Smokeloader, Pikabot, Bumblebee, QakBot, DanaBot, TrickBot, and, most recently in November 2025, the Rhadamanthys infostealer, VenomRAT, and the ElysiumDoppelPaymerSocGholish-related initial access has been tied to over half a dozen ransomware families including DoppelPaymer, WastedLoocker, Hades Ransomware, LockBit, RansomHub and more.ElysiumDanaBot, TrickBot, and, most recently in November 2025, the Rhadamanthys infostealer, VenomRAT, and the Elysium botnet.Hades RansomwareSocGholish-related initial access has been tied to over half a dozen ransomware families including DoppelPaymer, WastedLoocker, Hades Ransomware, LockBit, RansomHub and more.IcedIDEarlier “seasons” of Operation Endgame focused on known malware families such as IcedID, Smokeloader, Pikabot, Bumblebee, QakBot, DanaBot, TrickBot, and, most recently in November 2025, the Rhadamanthys infostealer,LockBitSocGholish-related initial access has been tied to over half a dozen ransomware families including DoppelPaymer, WastedLoocker, Hades Ransomware, LockBit, RansomHub and more.PikabotEarlier “seasons” of Operation Endgame focused on known malware families such as IcedID, Smokeloader, Pikabot, Bumblebee, QakBot, DanaBot, TrickBot, and, most recently in November 2025, the Rhadamanthys infostealer,Qakbotof Operation Endgame focused on known malware families such as IcedID, Smokeloader, Pikabot, Bumblebee, QakBot, DanaBot, TrickBot, and, most recently in November 2025, the Rhadamanthys infostealer, VenomRAT, and theRansomHubSocGholish-related initial access has been tied to over half a dozen ransomware families including DoppelPaymer, WastedLoocker, Hades Ransomware, LockBit, RansomHub and more.RhadamanthysSmokeloader, Pikabot, Bumblebee, QakBot, DanaBot, TrickBot, and, most recently in November 2025, the Rhadamanthys infostealer, VenomRAT, and the Elysium botnet.SmokeLoaderEarlier “seasons” of Operation Endgame focused on known malware families such as IcedID, Smokeloader, Pikabot, Bumblebee, QakBot, DanaBot, TrickBot, and, most recently in November 2025, the Rhadamanthys infostealer,SocGholishA multinational law enforcement action, part of Operation Endgame, has disrupted SocGholish, a notorious malware framework known for fake updates that provides initial access to other cybercriminals, including EvilCorp.TrickBotfocused on known malware families such as IcedID, Smokeloader, Pikabot, Bumblebee, QakBot, DanaBot, TrickBot, and, most recently in November 2025, the Rhadamanthys infostealer, VenomRAT, and the Elysium botnet.VenomRATBumblebee, QakBot, DanaBot, TrickBot, and, most recently in November 2025, the Rhadamanthys infostealer, VenomRAT, and the Elysium botnet.WastedLoockerSocGholish-related initial access has been tied to over half a dozen ransomware families including DoppelPaymer, WastedLoocker, Hades Ransomware, LockBit, RansomHub and more.
Vendors
BitdefenderCybersecurity firms including Proofpoint, CrowdStrike, Microsoft, Bitdefender, ESET, Shadowserver, Spamhaus, Spycloud, Have I Been Pwned, and with this latest iteration, Infoblox, have contributed threat intelligence,CrowdStrikeCybersecurity firms including Proofpoint, CrowdStrike, Microsoft, Bitdefender, ESET, Shadowserver, Spamhaus, Spycloud, Have I Been Pwned, and with this latest iteration, Infoblox, have contributed threat intelligence,ESETCybersecurity firms including Proofpoint, CrowdStrike, Microsoft, Bitdefender, ESET, Shadowserver, Spamhaus, Spycloud, Have I Been Pwned, and with this latest iteration, Infoblox, have contributed threat intelligence,Have I Been Pwnedincluding Proofpoint, CrowdStrike, Microsoft, Bitdefender, ESET, Shadowserver, Spamhaus, Spycloud, Have I Been Pwned, and with this latest iteration, Infoblox, have contributed threat intelligence, infrastructureInfobloxInfoblox Threat Intel is proud to be a partner in Operation Endgame.MicrosoftCybersecurity firms including Proofpoint, CrowdStrike, Microsoft, Bitdefender, ESET, Shadowserver, Spamhaus, Spycloud, Have I Been Pwned, and with this latest iteration, Infoblox, have contributed threat intelligence,ProofpointCybersecurity firms including Proofpoint, CrowdStrike, Microsoft, Bitdefender, ESET, Shadowserver, Spamhaus, Spycloud, Have I Been Pwned, and with this latest iteration, Infoblox, have contributed threat intelligence,ShadowserverCybersecurity firms including Proofpoint, CrowdStrike, Microsoft, Bitdefender, ESET, Shadowserver, Spamhaus, Spycloud, Have I Been Pwned, and with this latest iteration, Infoblox, have contributed threat intelligence,SpamhausCybersecurity firms including Proofpoint, CrowdStrike, Microsoft, Bitdefender, ESET, Shadowserver, Spamhaus, Spycloud, Have I Been Pwned, and with this latest iteration, Infoblox, have contributed threat intelligence,Spycloudfirms including Proofpoint, CrowdStrike, Microsoft, Bitdefender, ESET, Shadowserver, Spamhaus, Spycloud, Have I Been Pwned, and with this latest iteration, Infoblox, have contributed threat intelligence,
Products
Tools
Countries
Industries
BankingThe strongest concentration was observed in Government, Education, Banking, Healthcare, and Non-IT Services; see Figure 8.Critical infrastructureAt the same time, our impact analysis shows that the affected organizations were far from low value: three belonged to the government sector, two to the hospitality sector, and one operated in critical infrastructure.EducationThe strongest concentration was observed in Government, Education, Banking, Healthcare, and Non-IT Services; see Figure 8.GovernmentWe believe that government-industry partnerships are both necessary and effective in combating cybercrime.HealthcareThe strongest concentration was observed in Government, Education, Banking, Healthcare, and Non-IT Services; see Figure 8.HospitalityAt the same time, our impact analysis shows that the affected organizations were far from low value: three belonged to the government sector, two to the hospitality sector, and one operated in critical infrastructure.Non-IT ServicesThe strongest concentration was observed in Government, Education, Banking, Healthcare, and Non-IT Services; see Figure 8.