TA569

Reported Context (6)

Presented as the tracking name associated with SocGholish in the report's discussion of a June 2026 takedown. Infoblox 2026 Threat Landscape Report Highlights Rapidly Rotating Cybercrime Infrastructure
Listed among the aliases under which SocGholish operators have been tracked. Proofpoint said TA569 opportunistically compromises websites across many industries. Operation Endgame Takes Down 106 SocGholish Servers and Cleans Nearly 15,000 WordPress Sites
A name used to track the Russian-speaking threat actor operating SocGholish. The source says it indiscriminately compromised websites to inject the loader and also identifies the actor as DEV-0206, Gold Prelude, Mustard Tempest, and UNC1543. Authorities Disrupt SocGholish Botnet, Clean Nearly 15,000 WordPress Sites
Proofpoint describes TA569 as the operator of SocGholish fake-update web inject campaigns and reports that law enforcement disrupted its infrastructure during Operation Endgame. Operation Endgame Disrupts TA569’s SocGholish Infrastructure, Remediates 14,971 Websites
Operates the SocGholish framework and is described as an initial access broker. Operation Endgame Disrupts SocGholish Fake-Update Infrastructure

CVE (9)

Malware (28)

People (2)

Threat Actors (31)

MITRE ATT&CK (22)

Vendors (17)

Products (20)

Tools (6)

Industries (18)

Countries (15)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.