#malware disruption

SocGholish, the ‘drive by’ malware-as-a-service group known mostly for fake updates and brute force credential theft, has been disrupted by the international co-op Operation Endgame. I’ve reported on each of these separately in the past, covering SocGholish here, and earlier disruptions carried out by Operation Endgame here. The result of this campaign was the takedown of over a hundred domains in attacker control and the remediation of nearly 15K compromised WordPress sites.

WordPress is one of the largest platforms for deploying websites on the internet, and as such is a common target of threat actors. According to ShadowServer’s article on this disruption, as of June 2026 over 43% of websites are powered by the platform globally, many of them small to medium sized enterprises and individuals. SocGholish, which is also known as DEV-0206, GOLD PRELUDE, Mustard Tempest, TA569 and UNC1543, uses Traffic Direction/Distribution Systems (TDS) to redirect users to hijacked or malware injected secondary sites, usually legitimate but compromised, thus spreading their payload with opportunistic attacks rather than targeted ones. This is what sets SocGholish apart from phishing scammers; it’s less baiting victims and more ambushing them. Additionally the group practices ‘domain shadowing’, whereupon they gain access to the DNS providers and hosts. Infiltrating these processes at the first tier of traffic between sites means they in essence hide behind the legitimacy of these domains, and bypass security measures via exploitation of the established trust in them. Part of the difficulty in pinning SocGholish down has been the rapid turnover in domain cycling which is a hallmark of the group’s infrastructure. Defenders can find one, but the group simply moves on to the next.

This coordinated disruption was carried out last week by authorities from the Netherlands (NHCTU), Canada (RCMP), the United States (FBI) and Germany (BKA), with support from Europol and Eurojust, as well as private sector partners such as Infoblox (who also covered the campaign), Proofpoint and The Shadowserver Foundation. In total, 14,971 compromised legitimate WordPress sites infected with SocGholish malware were remediated and 106 servers and domains were taken down worldwide, disrupting the SocGholish botnet.

Victims of the compromised sites are urged to do the usual hardening of their systems: immediately change their login credentials, enable multi‑factor authentication (MFA/2FA), check for and delete any unknown additional WordPress accounts that have been added, and patch their WordPress site and keep their software and plugins up‑to‑date in the future. Furthermore, ShadowServer has provided a special report site to inform site owners and other potential victims not already notified if they are part of the list of the compromised sites. For everyone else, the same advice applies that always does: don’t click an untrusted link. SocGholish works by tricking users into clicking a popup that then redirects them to a secondary site where they download the malware through an alleged update. Real updates will always come from the vendor or system settings. This disruption is not likely to be the end of the group, but it is a significant win just the same.

AISURU/Kimwolf has become a problem for Microsoft and Android users respectively. The botnet has cumulatively carried out DDoS attacks in the range of dozens of terabytes per second over the course of the last several months. It came to my attention in November of 2025, which is when I wrote my first report on it. In that report, I compared AISURU to Star Trek’s Borg, assimilating compromised devices into a ‘hivemind’ relay to spread the malware.

The focus has more recently turned to Kimwolf, which is either the successor to AISURU, or simply an Android variant (as AISURU itself has reported to be a variant of the Linux worm, Mirai). Kimwolf relays itself through mostly TV streaming devices, typically off-brand, running Android. It turns those IP addresses held by private users into residential proxies, thereby blending in with normal internet traffic. I wrote a report on that just last week. In fact, I cited Brian Krebs’ research on the subject, and as it turns out, he’s been instrumental to the ongoing disruption of the botnet.

In short, Black Lotus Labs, the threat detection and research branch of Lumen Technologies, has successfully null-routed over 500 command-and-control nodes associated with AISURU/Kimwolf.

What does that mean in plain English? A null or black hole route is a network route that goes nowhere. In essence, a traffic ping fails to connect and does not tell the host. For context, system logs record every ping, whether they are successfully completed or not. As an aside, this is part of how I determine when internet activity is a threat versus normal traffic when doing analysis. I can literally see in front of me the host and client addresses. A null-route effectively drops into the void between IP addresses. And as evidenced by the disruption of this botnet, is one of the few ways to halt the progression of worm-like malware.

This tactic worked on AISURU/Kimwolf through the collaboration of several research teams to unravel the puzzle of where the botnet originates from and how it affects compromised devices. And how to stop it. Krebs figured out the main actors. Black Lotus Labs observed what they could of the C2 nodes based on those findings. XLab put together the first hints that Kimwolf was a related bot. Synthient discovered the method of local exploitation of vulnerabilities in targeted services, thereby revealing how the proxy gateways were being used. Along with advice on how to throttle the spread of proxy exploitation. All of it has been reported to law enforcement agencies. And me? I’m just here translating the technobabble and keeping an eye on the pattern (hence the higher than average number of external links).

The provider of AISURU/Kimwolf is now engaged in a game of cat and mouse, trying to stay ahead of the null-routing by shifting host domains and IP addresses. This is not a complete takedown, but it is a step in the right direction. This is the third time I’ve written a report on this botnet. I doubt it will be the last.