Authorities Disrupt SocGholish Botnet, Clean Nearly 15,000 WordPress Sites
Summary
Authorities in four countries, Europol and private partners disrupted SocGholish infrastructure, taking down 106 command-and-control servers and domains and removing malware from nearly 15,000 infected WordPress sites.
Key points
- Authorities in the Netherlands, Canada, the US and Germany, with Europol support, took down 106 SocGholish command-and-control servers and domains.
- The operation removed backdoors and malware from 14,971 infected WordPress websites.
- SocGholish, also known as FakeUpdates, has been active since 2017 and can be injected into websites through known vulnerabilities or stolen credentials.
- The JavaScript-based framework can replace a webpage with a fake browser update to trick visitors into downloading malware.
- Orange’s cyber defense unit observed SocGholish delivering Gholoader and MintsLoader, followed by payloads including GhostWeaver, LockBit, RansomHub, AsyncRAT and NetSupport RAT.
- Dutch police urged identified site owners to change compromised logins, enable MFA, remove suspicious accounts and update their sites.
Article Details
- Event Type
- Law enforcement disruption of SocGholish infrastructure and cleanup of infected WordPress websites.
- Impact
- Authorities in the Netherlands, Canada, the US, and Germany, with Europol support, took down 106 command-and-control servers and domains associated with SocGholish and removed backdoors and malware from 14,971 infected WordPress websites. The Dutch police said owners whose compromised credentials were identified were notified and urged to change logins, enable MFA, delete suspect accounts, and update their sites. Infoblox reported that approximately 55% of cloud customers were exposed to SocGholish this year; ShadowServer Foundation reported more than 1.44 million compromised WordPress websites available for its use in May.
MITRE ATT&CK
Threat Actors
DEV-0206A Russian-speaking threat actor operating SocGholish; the source says it is also tracked as Gold Prelude, Mustard Tempest, TA569, and UNC1543.Evil CorpThe SocGholish operator has been associated with Evil Corp, which the source describes as believed to be linked to Russian intelligence.Gold PreludeA name used to track the Russian-speaking threat actor operating SocGholish; the source also identifies it as DEV-0206, Mustard Tempest, TA569, and UNC1543.Mustard TempestA name used to track the Russian-speaking threat actor operating SocGholish; the source also identifies it as DEV-0206, Gold Prelude, TA569, and UNC1543.TA569A name used to track the Russian-speaking threat actor operating SocGholish. The source says it indiscriminately compromised websites to inject the loader and also identifies the actor as DEV-0206, Gold Prelude, Mustard Tempest, and UNC1543.UNC1543A name used to track the Russian-speaking threat actor operating SocGholish; the source also identifies it as DEV-0206, Gold Prelude, Mustard Tempest, and TA569.
Malware
AsyncRATled to payloads such as the GhostWeaver PowerShell backdoor, LockBit and RansomHub ransomware, and AsyncRAT or NetSupport RAT backdoors.GholoaderOrange’s cyber defense unit observed SocGholish delivering loaders like Gholoader and MintsLoader, which eventually led to payloads such as the GhostWeaver PowerShell backdoor, LockBit and RansomHub ransomware, andGhostWeaverdelivering loaders like Gholoader and MintsLoader, which eventually led to payloads such as the GhostWeaver PowerShell backdoor, LockBit and RansomHub ransomware, and AsyncRAT or NetSupport RAT backdoors.LockBitGholoader and MintsLoader, which eventually led to payloads such as the GhostWeaver PowerShell backdoor, LockBit and RansomHub ransomware, and AsyncRAT or NetSupport RAT backdoors.MintsLoaderOrange’s cyber defense unit observed SocGholish delivering loaders like Gholoader and MintsLoader, which eventually led to payloads such as the GhostWeaver PowerShell backdoor, LockBit and RansomHub ransomware, andNetSupport RATsuch as the GhostWeaver PowerShell backdoor, LockBit and RansomHub ransomware, and AsyncRAT or NetSupport RAT backdoors.RansomHubMintsLoader, which eventually led to payloads such as the GhostWeaver PowerShell backdoor, LockBit and RansomHub ransomware, and AsyncRAT or NetSupport RAT backdoors.SocGholishLaw enforcement agencies in four countries, working with Europol and private partners, have disrupted SocGholish infrastructure and cleaned up nearly 15,000 infected WordPress websites.
Products
Drupalinjected into websites running popular content management systems, such as WordPress, Joomla, and Drupal, either via known vulnerabilities or stolen credentials.Joomlaa malware framework injected into websites running popular content management systems, such as WordPress, Joomla, and Drupal, either via known vulnerabilities or stolen credentials.WordPressLaw enforcement agencies in four countries, working with Europol and private partners, have disrupted SocGholish infrastructure and cleaned up nearly 15,000 infected WordPress websites.
Countries
CanadaAuthorities in the Netherlands, Canada, the US, and Germany, with support from Europol, took down 106 command-and-control (C&C) servers and domains associated with SocGholish, and removed backdoors and malware fromGermanyAuthorities in the Netherlands, Canada, the US, and Germany, with support from Europol, took down 106 command-and-control (C&C) servers and domains associated with SocGholish, and removed backdoors and malware fromNetherlandsAuthorities in the Netherlands, Canada, the US, and Germany, with support from Europol, took down 106 command-and-control (C&C) servers and domains associated with SocGholish, and removed backdoors and malware from
Industries
MediaTA569 has been observed indiscriminately compromising websites to inject the SocGholish loader, including prominent media and retail portals visited by millions of users daily.RetailTA569 has been observed indiscriminately compromising websites to inject the SocGholish loader, including prominent media and retail portals visited by millions of users daily.