Operation Endgame: Investigators clean thousands of blogs of SocGholish

In a new edition of “Operation Endgame”, international investigators have achieved success against the malware “SocGholish”. They cleaned up almost 15,000 infected Wordpress blogs and took botnet infrastructures offline. The operators of the criminal networks are a gang called “Evil Corp”, which has been making money from cybercrime from Russia for more than half a decade.

As the Dutch police have now announced, investigators there, together with Canadian, US and German law enforcement officers, have taken 106 servers and domains of the SocGholish backend offline and repaired 14,971 websites. The “cleaning of infected Wordpress pages”, which was not further elaborated, was accompanied by a notification to the victims and also included an urgent reminder to install updates for the popular blog software more quickly in the future.

In addition, investigators found over 1.4 million access credentials for blogs, whose owners they intend to notify using services such as HaveIBeenPwned. They also call on Wordpress admins to change their access credentials, delete unknown or unused accounts in the blog, and always keep their Wordpress installation up to date.

“Operation Endgame” is the name of a large-scale operation against cybercriminals , the malware ecosystem and digital extortion. The investigators have divided it into seasons in the style of a TV series and often publish short AI-generated videos with which they put pressure on criminals and encourage them to betray their accomplices. This time too: a black-and-white video in the style of the comic book adaptation “Sin City” shows an investigator in a fedora and trench coat hunting the SocGholish gangsters.

This article was originally published in German . It was translated with technical assistance and editorially reviewed before publication.