Operation Endgame: crackdown on cybercriminal networks behind SocGholish, Amadey and StealC malwares

TLTR

• On June 18, 2026, a new crackdown led by Europol, as part of Operation Endgame, targeted the cybercriminal infrastructure behind the malware tools SocGholish, Amadey, and StealC ; 
• As part of the operation, over 14,971 infected sites were cleaned. Additionally, 326 C2 servers and 142 illicit domain names were dismantled. A significant amount of illicitly obtained crypto assets, valued at €41 million, along with 27 million stolen credentials, were recovered ; 
• Despite the scale of this crackdown, the threat remains, with cybercriminals showing increasing adaptability, which requires ongoing surveillance, regular system updates, and strengthened collaboration between the public and private sectors. In this context, relying on in-depth expertise and threat intelligence is a key asset for authorities and law enforcement agencies.

A new milestone in the fight against cybercrime

On June 18, 2026, a law enforcement operation as part of Operation Endgame ⁽¹⁾ significantly curtailed some of the most harmful cybersecurity threats known as SocGholish, Amedey and StealC malware operators. Led by Europol in coordination with authorities from the Netherlands, Canada, the United States, and Germany, this operation resulted in the cleanup of over 14,971 compromised websites and the takedown of 326 command and control (C2) servers and 142 illicit domains. Additionally, 27 million stolen credentials were recovered ⁽²⁾. It is important to provide the context of this crackdown to fully appreciate its impact. This article offers an in-depth analysis of SocGholish, a threat monitored for years by the Orange Cyberdefense CERT, highlighting its methods, its role within the cybercriminal ecosystem, and what this disruption means for defenders.

Malware networks under attack: SocGholish, Amadey, and StealC

This latest instalment of Operation Endgame dealt a serious blow to three malware operators:

1. SocGholish malware allowed cybercriminals to access computer systems by distributing fake browser updates via compromised websites. Instead of the legitimate update, users inadvertently installed the malware. This method, which caused many victims, primarily spread by infecting websites built with CMS platforms like WordPress or Joomla. The initial unauthorized access then served as a backdoor exploited for other malicious activities, such as installing ransomware for digital extortion ; 
2. StealC malware was mainly designed to extract sensitive information such as passwords and digital credentials from compromised computers, with the aim of selling them on the dark web for fraudulent use ; 
3. Amadey malware was primarily distributed through phishing campaigns. As the first link in a broader attack chain, it was capable of introducing additional malware into compromised systems. This malware also facilitated data theft, allowing it to retrieve sensitive information.

What is SocGholish? More than just Malware

Orange Cyberdefense experts contributed to these arrests by sharing their threat knowledge with authorities. Since 2017, they have been tracking the activity of the group behind SocGholish, and to give you an idea of the damage that just one of these three malware can cause, let's focus on this one.

The Initial Access Broker

The Initial Access Broker First and foremost, it's important to clarify that SocGholish is not typically the final step in an attack. It is a JavaScript-based downloader, and its primary operator - a Russian-speaking, financially motivated threat actor - functions as an Initial Access Broker (IAB). This group is tracked under various aliases across the security industry, including TA569, UNC1543, Mustard Tempest, and GOLD PRELUDE.

An IAB's business model is simple yet effective: they specialize in gaining initial entry into corporate and personal networks and then sell that access to other criminal groups. These "customers" then deploy their own malicious payloads, such as ransomware, spyware, or banking trojans. In essence, SocGholish is at the beginning of the cyber kill chain and not the final blow. Active since at least 2017, its longevity and widespread use have made it a cornerstone of the Cybercrime-as-a-Service economy.

Anatomy of a SocGholish Attack

The Orange CyberdefenseCSIRT team had the opportunity to document the infection chain employed by TA569, which is remarkably consistent and relies heavily on social engineering.

• Step 1: The website Compromise  

• Step 2: The "Fake Update" Lure  

• Step 3: The Payload Execution  

• Step 4: The Follow-on Malware  

Once active, SocGholish connects to its C2 infrastructure and deploys a variety of second-stage payloads. We have observed it delivering loaders like Gholoader and MintsLoader, which in turn lead to more dangerous malware. Examples of final payloads delivered via SocGholish include:

- GhostWeaver: a PowerShell backdoor stealing credentials and cryptocurrency wallet information from web forms.

- Ransomware: historically, SocGholish was a key entry point for LockBit affiliates and, has been observed leading to RansomHub deployments.

- Remote Access Trojans (RATs): AsyncRAT orNetSupport RAT have been deployed to give attackers full control over a compromised system.

SocGholish uses a layered delivery model and has been observed enabling multiple categories of follow-on payloads.

A Crowded and Collaborative Underworld

Operation Endgame's Impact and Our Recommendations

The actions taken during Operation Endgame are a significant blow to this kind of threat actor’s operations. Here, by disinfecting tens of thousands of websites, taking down C2 servers, and seizing domains, law enforcement has directly attacked the group's infrastructure. Even if these disruptions do not always totally cease the malicious actions, they increase the cost and complexity of their attacks and provide a window of opportunity for defenders to bolster their security.

Based on our intelligence and the guidance from law enforcement, we provide the following recommendations:

For Website Administrators:

• Update your CMS: keep your CMS like WordPress, Joomla etc., plugins, and themes constantly updated to prevent vulnerabilities from being exploited. 

For End-Users:

• Be Skeptical of Pop-ups: never trust a software update that comes from a pop-up in your browser. 

For Security Teams:

• Leverage Threat Intelligence: The C2 infrastructure for SocGholish is known to rotate frequently (every 2-5 days). Subscribing to timely and actionable threat intelligence feeds like the one provided by Orange Cyberdefense is crucial for blocking connections to new malicious domains and IPs.

Defeat modern cybercrime by leveraging cyber threat intelligence

Sources