Operation Endgame Disrupts Soc Gholish Servers, Cleans 14,971 Word Press Sites
Summary: Dutch law enforcement, working with Canada, Germany, and the U.S. under Operation Endgame, took down 106 servers tied to the SocGholish downloader and cleaned 14,971 infected WordPress sites, notifying owners to update their CMS, change credentials, and remove suspicious accounts. SocGholish, active since 2017 and also known as FakeUpdates, spreads through compromised websites posing as browser updates and has been used to deliver next-stage malware for groups including Evil Corp, LockBit, RansomHub, Dridex, and Raspberry Robin.
What's compelling: Infoblox data cited here shows about 55% of its cloud customers attempted to reach SocGholish infrastructure this year, across government, education, banking, healthcare, and utilities - so the 14,971 cleaned sites are a fraction of an ecosystem that already reaches most of your peers.
Read the original at The Hacker News ↗
- Topics
- Cybercrime & Law Enforcement
- Related
- Gootloader Malware Disrupted After Infecting 25,000 Computers Cyber Risks · Nov 13, 2026354 dark web vendors and buyers arrested in Operation Tor Nado Cyber Risks · Nov 13, 2026Law Enforcement Disrupts Gootloader, CastleRAT, and StealC Infrastructure Cyber Risks · Nov 13, 2026