International Operation Disrupts SocGholish Botnet Linked to Evil Corp
Summary
Authorities from four countries seized domains, took down more than 100 SocGholish servers and disinfected nearly 15,000 compromised websites, disrupting a malware platform linked to ransomware and espionage activity.
Key points
- Authorities from the Netherlands, Canada, the United States and Germany dismantled key parts of the SocGholish botnet.
- The operation took down more than 100 servers and seized domains used to infect visitors to legitimate websites.
- Dutch police said they removed malware and backdoors from thousands of infected WordPress sites and notified their owners.
- SocGholish, also known as FakeUpdates, spreads through fake browser or software update prompts on legitimate sites.
- The FBI described the malware as providing an initial foothold for further ransomware and espionage campaigns.
- Researchers at Infoblox said SocGholish has served as an entry point for ransomware groups including DoppelPaymer, WastedLocker, Hades, LockBit and RansomHub.
Article Details
- Event Type
- International law enforcement disruption of the SocGholish botnet through domain seizures, server takedowns, and remediation of compromised websites.
- Impact
- Authorities took down more than 100 servers and disinfected nearly 15,000 compromised websites. The operation disrupted infrastructure used to spread malware through fake update prompts and to provide an initial foothold for ransomware and espionage activity.
MITRE ATT&CK
People
Threat Actors
DoppelpaymerResearchers at Infoblox said SocGholish has served as an entry point for this ransomware group.Evil CorpSocGholish has long been associated with Evil Corp. The article describes Evil Corp as a Russia-based cybercrime group and says U.S. authorities sanctioned it in 2019 for developing and distributing Dridex.HadesResearchers at Infoblox said SocGholish has served as an entry point for this ransomware group.LockBitResearchers at Infoblox said SocGholish has served as an entry point for this ransomware group.RansomHubResearchers at Infoblox said SocGholish has served as an entry point for this ransomware group.WastedLockerResearchers at Infoblox said SocGholish has served as an entry point for this ransomware group.
Malware
Vendors
Products
Countries
CanadaAuthorities from the Netherlands, Canada, the United States and Germany said Thursday they dismantled key parts of the SocGholish botnet by seizing domain names and shutting down servers used to infect visitors toGermanyAuthorities from the Netherlands, Canada, the United States and Germany said Thursday they dismantled key parts of the SocGholish botnet by seizing domain names and shutting down servers used to infect visitors toNetherlandsAuthorities from the Netherlands, Canada, the United States and Germany said Thursday they dismantled key parts of the SocGholish botnet by seizing domain names and shutting down servers used to infect visitors toRussiaAn international law enforcement operation has disrupted a malware network linked to the Russia-based cybercrime group Evil Corp, taking down more than 100 servers and disinfecting nearly 15,000 hacked websites used toUnited StatesAuthorities from the Netherlands, Canada, the United States and Germany said Thursday they dismantled key parts of the SocGholish botnet by seizing domain names and shutting down servers used to infect visitors to