International law enforcement agencies have dismantled a significant portion of the SocGholish botnet infrastructure, cleaning nearly 15,000 compromised WordPress websites and seizing over 100 servers. The operation targeted the malware distribution network tied to the notorious Russian cybercrime group Evil Corp.
The takedown represents one of the largest coordinated disruptions of a malware delivery platform. SocGholish, a JavaScript-based downloader, has been used for years to deliver ransomware and other payloads by compromising legitimate websites, often through vulnerable WordPress installations.
Technical analysis of the operation shows that law enforcement gained access to command-and-control infrastructure and removed malicious scripts from infected sites. The cleanup prevents further victim exposure to follow-on threats such as LockBit or Ryuk ransomware, which SocGholish has historically been used to deploy.
No specific patches have been announced, but WordPress site administrators are advised to update their software and plugins immediately, enable multifactor authentication, and scan for any remaining malicious files. The seizure of servers prevents the botnet from operating at its previous scale, though remnants may persist.
Attribution points to Evil Corp, a Russian cybercrime syndicate long linked to widespread ransomware campaigns. The coordinated action by international law enforcement underscores ongoing efforts to disrupt state-aligned criminal groups operating across borders.