kyber.today

daily cyber × ai intelligence

← threat actors

threat actor · not yet in the cluster map

socgholish

also tracked as evil corp 1

2 stories · 2 in the wild · June 19, 2026 – June 21, 2026

evidence: 2 observed

sectors

  • critical infrastructure 1 · Jun 21

geography

  • canada 1 · Jun 21
  • germany 1 · Jun 21
  • netherlands 1 · Jun 21
  • united states 1 · Jun 21

malware and tools

  • socgholish 2 · Jun 21
  • fakeupdates 1 · Jun 19

what we reported, newest first, grouped by story

Jun 19 – June 21, 2026 · 2 reports

  • Operation Endgame dismantled SocGholish infrastructure — 106 C2 servers and domains taken down and nearly 15,000 infected WordPress sites cleaned, led by Dutch, Canadian, German, and U.S. authorities (The Hacker News, SecurityWeek). · Jun 21 · observed · Ransomware & EDR Evasion
  • Operation Endgame disrupted the SocGholish/FakeUpdates chain tied to Evil Corp, remediating 14,971 infected WordPress sites and taking down 106 servers/domains; police flagged leaked credentials tied to ~1.4M sites (SecurityWeek, BleepingComputer). · Jun 19 · observed · as evil corp · Threat Activity & Intrusions