Major Law Enforcement Operation Disrupts Evil Corp’s Malware Network

An alarming but necessary step has been taken against the notorious cybercrime group Evil Corp, known primarily for its involvement in the SocGholish malware network. Recently, an extensive international law enforcement operation resulted in a significant blow to this group, dismantling a crucial part of their infrastructure and disrupting their illicit activities.

The Breakdown of SocGholish

The operation, which involved collaboration among authorities from the Netherlands, Canada, the United States, and Germany, successfully took down over 100 servers and disinfected approximately 15,000 websites that had been compromised. The SocGholish malware, also referred to as FakeUpdates, has been active since 2017, primarily spread through deceptive prompts appearing on legitimate websites—like those belonging to small businesses, restaurants, and auto repair shops.

Takedown and Cleanup Efforts

In this coordinated effort, Dutch police played a pivotal role not only by seizing malicious domain names but also by removing malware and backdoors from thousands of infected WordPress websites. They proactively notified the owners of these compromised sites, ensuring that many businesses could take immediate action to secure their online presence.

The Threat of SocGholish

SocGholish operates by tricking users with fake browser or software update notifications. Once installed, it acts as a sophisticated gateway for further malicious exploitation. The malware establishes a foothold within victim computers, effectively forming a botnet that cybercriminals can use for more sinister purposes, including ransomware attacks and data espionage.

The FBI’s Cyber Division underscored the seriousness of this malware by emphasizing its role in facilitating additional hacking efforts, enabling attackers to launch extensive ransomware campaigns against unsuspecting victims.

Evil Corp’s Dark Legacy

Evil Corp is not a new player in the cybercrime sphere. In 2019, the United States imposed sanctions on this group due to its role in the development and spread of the Dridex banking malware. This notorious malware has reportedly caused financial losses exceeding $100 million globally. For years, Evil Corp has become synonymous with high-stakes cyber threats and has been linked to various ransomware groups, including DoppelPaymer, WastedLocker, LockBit, and others.

Collaborative Efforts for Cybersecurity

The operation was bolstered by the involvement of cybersecurity firm Infoblox, which assisted law enforcement in identifying and dismantling the SocGholish botnet. Researchers highlight that this malware has acted as an entry point for multiple ransomware groups, indicating the interconnected nature of today’s cybercriminal networks.

A Preventative Measure for the Future

Maikel Rollman, a representative from the Dutch National High Tech Crime Unit, remarked on the importance of this operation in nullifying cybercriminals’ access to infected systems. “This marks the beginning of further action against SocGholish,” he stated, signaling that law enforcement’s efforts will continue to intensify as they aim to mitigate risks and protect individuals, businesses, and organizations from falling prey to such attacks in the future.

This operation not only represents a significant step in combating cybercrime but also serves as a reminder of the collaborative efforts necessary to confront the evolving digital threats that pervade our online landscape.

Get more insights with the Recorded Future Intelligence Cloud. Learn more.