kyber.today

daily cyber × ai intelligence

← threat actors

threat actor

Evil Corp

also tracked as socgholish 1

2 stories · 1 in the wild · June 19, 2026 – June 20, 2026

evidence: 1 observed

geography

  • canada 1 · Jun 20
  • germany 1 · Jun 20
  • netherlands 1 · Jun 20
  • united states 1 · Jun 20

malware and tools

  • socgholish 2 · Jun 20
  • fakeupdates 1 · Jun 19

what we reported, newest first, grouped by story

Jun 19 – June 20, 2026 · 2 reports

  • Operation Endgame dismantled 106 SocGholish C2 servers/domains and cleaned ~15,000 infected WordPress sites tied to Evil Corp, in a Dutch/Canadian/German/U.S. action. The Hacker News, SecurityWeek · Jun 20 · none · Threat Intelligence & Espionage
  • Operation Endgame disrupted the SocGholish/FakeUpdates chain tied to Evil Corp, remediating 14,971 infected WordPress sites and taking down 106 servers/domains; police flagged leaked credentials tied to ~1.4M sites (SecurityWeek, BleepingComputer). · Jun 19 · observed · as socgholish · Threat Activity & Intrusions