Authorities Disrupt SocGholish Botnet Linked to Evil Corp
Summary
A multinational operation disrupted the SocGholish (FakeUpdates) botnet, taking down 106 servers and remediating nearly 15,000 infected websites. Authorities also warned that traffic distribution systems are used to deliver ransomware and phishing attacks.
Key points
- The operation targeted SocGholish, also known as FakeUpdates, which has compromised websites and redirected users through traffic distribution systems since 2017.
- Authorities and participating organizations took down 106 servers, remediated nearly 15,000 infected websites, disabled the botnet, and notified victims.
- The FBI said the malware established initial footholds that threat actors used for further targeting, including ransomware campaigns and espionage.
- SocGholish is linked to Evil Corp and reportedly provided initial access for other ransomware groups, according to Infoblox.
- Authorities warned that traffic distribution systems can redirect users to phishing pages and facilitate credential theft, financial scams, malware delivery, and network access.
- The takedown was part of the multinational Operation Endgame and the FBI's Operation Riptide.
Article Details
- Event Type
- Law enforcement disruption and infrastructure seizure targeting the SocGholish botnet.
- Impact
- Authorities seized 106 servers, remediated nearly 15,000 infected websites, disabled the botnet, and notified victims. The infrastructure had been used to redirect users to malware and phishing pages and to provide initial access for ransomware and espionage activity.
MITRE ATT&CK
Threat Actors
Malware
DoppelPaymerIt also provided initial access to other ransomware variants, including DoppelPaymer, WastedLoocker, Hades Ransomware, LockBit, RansomHub and others, according to Infoblox, which participated in the takedown.Hades RansomwareIt also provided initial access to other ransomware variants, including DoppelPaymer, WastedLoocker, Hades Ransomware, LockBit, RansomHub and others, according to Infoblox, which participated in the takedown.LockBitIt also provided initial access to other ransomware variants, including DoppelPaymer, WastedLoocker, Hades Ransomware, LockBit, RansomHub and others, according to Infoblox, which participated in the takedown.RansomHubIt also provided initial access to other ransomware variants, including DoppelPaymer, WastedLoocker, Hades Ransomware, LockBit, RansomHub and others, according to Infoblox, which participated in the takedown.SocGholishAuthorities disrupted the SocGholish botnet, also known as FakeUpdates, and seized infrastructure used by Evil Corp and other cybercrime groups to steal data and gain network access.WastedLoockerIt also provided initial access to other ransomware variants, including DoppelPaymer, WastedLoocker, Hades Ransomware, LockBit, RansomHub and others, according to Infoblox, which participated in the takedown.
Products
Countries
CanadaCybersecurity firms, researchers and officials from the United States, Canada, Germany, the Netherlands and Europol took down 106 servers and remediated nearly 15,000 sites that were infected with the malware.GermanyCybersecurity firms, researchers and officials from the United States, Canada, Germany, the Netherlands and Europol took down 106 servers and remediated nearly 15,000 sites that were infected with the malware.NetherlandsCybersecurity firms, researchers and officials from the United States, Canada, Germany, the Netherlands and Europol took down 106 servers and remediated nearly 15,000 sites that were infected with the malware.United StatesCybersecurity firms, researchers and officials from the United States, Canada, Germany, the Netherlands and Europol took down 106 servers and remediated nearly 15,000 sites that were infected with the malware.