cyber.hendryadrian.com
Security News · bleepingcomputer.com

Authorities Clean SocGholish From 14,971 WordPress Sites, Take Down 106 Servers

· Original article ↗

Summary

As part of Operation Endgame, international law enforcement cleaned SocGholish from 14,971 WordPress sites and took 106 related servers and domains offline. The malware uses fake browser updates to deliver additional payloads.

Key points

  • Authorities from the Netherlands, Canada, the United States and Germany cleaned SocGholish infections from 14,971 WordPress websites.
  • The operation took 106 servers and domains linked to the malware operation offline, with support from Europol and Eurojust.
  • SocGholish, also known as FakeUpdates and GhoLoader, hijacks legitimate websites and tricks visitors into installing malware disguised as browser updates.
  • The downloader has been used to deliver other malware, including Dridex, Doppelpaymer and Azorult.
  • Dutch police advised affected site owners to change credentials, enable multi-factor authentication, remove unknown WordPress accounts and keep sites updated.

Article Details

Event Type
International law enforcement disruption of SocGholish infrastructure and cleanup of compromised websites.
Impact
Authorities cleaned 14,971 infected WordPress websites and took 106 servers and domains offline. The action was intended to disrupt SocGholish’s infection chain and limit further malware spread and potential attacks on critical infrastructure.

People

Maikel RollmanQuoted as a representative of the Netherlands’ National High Tech Crime Unit about the law enforcement action against SocGholish.

Threat Actors

Evil CorpThe article describes SocGholish infrastructure as linked to Evil Corp and identifies Evil Corp as a Russian cybercrime group associated with the malware.

Malware

AzoRultSocGholish has also been used to deploy other malware families, including Dridex, Doppelpaymer, Empire, Koadic, Chtonic, and Azorult.ChtonicSocGholish has also been used to deploy other malware families, including Dridex, Doppelpaymer, Empire, Koadic, Chtonic, and Azorult.DoppelPaymerSocGholish has also been used to deploy other malware families, including Dridex, Doppelpaymer, Empire, Koadic, Chtonic, and Azorult.DridexSocGholish has also been used to deploy other malware families, including Dridex, Doppelpaymer, Empire, Koadic, Chtonic, and Azorult.EmpireSocGholish has also been used to deploy other malware families, including Dridex, Doppelpaymer, Empire, Koadic, Chtonic, and Azorult.Gholoader#SocGholishHades2007 that has been associated with the Zeus and Dridex malware families and was behind the WastedLocker, Hades, Macaw Locker, and Phoenix CryptoLocker ransomware operations.KoadicSocGholish has also been used to deploy other malware families, including Dridex, Doppelpaymer, Empire, Koadic, Chtonic, and Azorult.Macaw Lockerhas been associated with the Zeus and Dridex malware families and was behind the WastedLocker, Hades, Macaw Locker, and Phoenix CryptoLocker ransomware operations.Phoenix CryptoLockerthe Zeus and Dridex malware families and was behind the WastedLocker, Hades, Macaw Locker, and Phoenix CryptoLocker ransomware operations.SocGholishInternational law enforcement agencies removed SocGholish infections from nearly 15,000 WordPress websites and shut down more than 100 servers and domains tied to the botnet.Wastedlockersince 2007 that has been associated with the Zeus and Dridex malware families and was behind the WastedLocker, Hades, Macaw Locker, and Phoenix CryptoLocker ransomware operations.Zbotlinked to Evil Corp, a Russian cybercrime gang active since 2007 that has been associated with the Zeus and Dridex malware families and was behind the WastedLocker, Hades, Macaw Locker, and Phoenix CryptoLocker

Products

WordPressInternational law enforcement agencies removed SocGholish infections from nearly 15,000 WordPress websites and shut down more than 100 servers and domains tied to the botnet.

Countries

CanadaAuthorities from the Netherlands (NHCTU), Canada (RCMP), the United States (FBI), and Germany (BKA) cleaned SocGholish malware infections from 14,971 compromised WordPress websites and took 106 servers and domainsGermanyAuthorities from the Netherlands (NHCTU), Canada (RCMP), the United States (FBI), and Germany (BKA) cleaned SocGholish malware infections from 14,971 compromised WordPress websites and took 106 servers and domainsNetherlandsAuthorities from the Netherlands (NHCTU), Canada (RCMP), the United States (FBI), and Germany (BKA) cleaned SocGholish malware infections from 14,971 compromised WordPress websites and took 106 servers and domainsUnited StatesAuthorities from the Netherlands (NHCTU), Canada (RCMP), the United States (FBI), and Germany (BKA) cleaned SocGholish malware infections from 14,971 compromised WordPress websites and took 106 servers and domains

Related Articles