Back Ground.News

Police cleans nearly 15,000 SocGholish-infected sites tied to Evil Corp

Ground.News • June 18, 2026

International law enforcement agencies cleaned nearly 15,000 malware-infected WordPress websites and took down more than 100 servers linked to the SocGholish botnet and the Evil Corp Russian cybercrime group.

International law enforcement dismantled TA569’s SocGholish infrastructure, taking down over 100 C2 servers and remediating nearly 15,000 compromised websites. This article has been indexed from Hackread – Cybersecurity News, Data Breaches, AI and More Read the original article: Operation Endgame Disrupts SocGholish Malware Infrastructure

SocGholish, an operation that's been delivering malware to users via fake software updates, has suffered a major blow.

To view factuality data please Upgrade to Premium

To view ownership data please Upgrade to Vantage

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Operation Endgame Disrupts Evil Corp's SocGholish Malware Network On June 18, 2026, international law enforcement agencies launched Operation Endgame, disrupting the SocGholish malware infrastructure linked to the Russian cybercrime group Evil Corp. The operation resulted in the remediation of 14,971 infected WordPress websites and the takedown of 106 servers and domains associated with the SocGholish botnet. SocGholish, also known as FakeUpdates, exploits compromised legitimate websites to deliver malware disguised as fake software updates, targeting users to gain unauthorized access to their systems. The operation was a collaborative effort involving law enforcement from the Netherlands, Canada, the United States, and Germany, supported by Europol. This action is expected to significantly impact the operations of Evil Corp and its affiliates, limiting their ability to execute further attacks. Authorities have advised website owners to enhance their security measures, including changing credentials and enabling multi-factor authentication. 67 sources 78

Extracted Entities

Police cleans nearly 15,000 SocGholish-infected sites tied to Evil Corp

The full story

Extracted Entities

APT Groups (1)

Attack Types (2)

Campaigns (1)

Malware (1)

MITRE ATT&CK (1)

Platforms (1)