Global Law Enforcement Disrupts SocGholish Malware Network in Major Cybercrime Takedown An international law enforcement operation has dismantled a vast cybercriminal network linked to the SocGholish malware, disrupting a botnet used to distribute ransomware and other malicious payloads. The takedown, announced by Dutch police on June 18, was part of Operation Endgame, a global initiative targeting ransomware and cybercrime. The SocGholish group, tracked by cybersecurity firm Proofpoint as TA569, compromised 15,000 legitimate WordPress websites by exploiting leaked credentials or hacking into them. These sites were then used to serve malicious pop-ups, tricking visitors into downloading fake software updates that infected their systems. Once compromised, devices were ensnared into the SocGholish botnet, which was frequently leveraged by Evil Corp, a Russia-linked cybercrime syndicate responsible for high-profile attacks on governments, healthcare institutions, and enterprises. The operation, conducted over a week, resulted in the seizure of 106 servers and domains tied to the malware and the remediation of infected websites. Authorities from the Netherlands (NHCTU), Canada (RCMP), Germany (BKA), and the U.S. (FBI) collaborated on the effort, with support from Europol, Eurojust, and private cybersecurity partners like Infoblox. Maikel Rollman of the Dutch NHCTU stated that the action cut off cybercriminals’ access to infected systems, reducing the risk of further attacks on critical infrastructure. Dr. Renée Burton of Infoblox emphasized the threat’s broad reach, noting that SocGholish’s activities enabled other criminals to infiltrate networks. Website owners were notified of the breaches and advised to update credentials and apply security patches to prevent reinfection. The operation marks the first phase of continued efforts to dismantle SocGholish’s infrastructure.