We’re always happy to end the week with some positive news. A law enforcement action called Operation Endgame just delivered a major win against the long‑running SocGholish (aka FakeUpdates) operation.
SocGholish is a malware framework that has been active since at least 2017 and is best known for abusing hacked, legitimate WordPress sites to push fake browser and software updates to visitors. When a user clicks one of these convincing “update now” prompts, the malware opens a backdoor on the
We’re always happy to end the week with some positive news. A law enforcement action called Operation Endgame just delivered a major win against the long‑running SocGholish (aka FakeUpdates) operation.
SocGholish is a malware framework that has been active since at least 2017 and is best known for abusing hacked, legitimate WordPress sites to push fake browser and software updates to visitors. When a user clicks one of these convincing “update now” prompts, the malware opens a backdoor on the system, giving attackers initial access that is often used to deploy ransomware and other malicious software. The operation has been linked to the Russian cybercriminal group Evil Corp, previously associated with Zeus and Dridex malware, as well as major ransomware and money‑laundering schemes.
This week, Dutch police and the Public Prosecution Service, working with the Royal Canadian Mounted Police, FBI, German Federal Criminal Police Office, Europol, and Eurojust, struck directly at SocGholish’s infrastructure. As part of Operation Endgame, they took down 106 servers and domains and cleaned 14,971 infected WordPress sites that had been silently redirecting visitors into the FakeUpdates trap.
Investigators say they found exposed login credentials for around 1.4 million WordPress sites. To check whether any passwords associated with your email address have been exposed in a breach, use Malwarebytes Digital Footprint Scanner.
Dutch authorities also used their hacking powers to remove backdoors and malware from compromised sites and notified affected site owners, urging them to update WordPress, enable multi-factor authentication (MFA), and change passwords.
Authorities say the infected sites included everyday businesses such as restaurants and car garages, meaning visitors could have been exposed to malware simply by browsing trusted local websites.
The scale and intent matter here. Endgame is billed as the largest international operation against ransomware and cybercrime to date, and this SocGholish takedown specifically disrupts a key infection chain used by multiple ransomware groups. By breaking the link between thousands of everyday websites and a sophisticated malware‑as‑a‑service ecosystem, law enforcement has reduced the pool of future victims and increased the cost of operating for Evil Corp and its partners.
So, as you head into the weekend, here’s a malware story where the good guys actually pushed back and made it hurt.
We don’t just report on threats—we remove them
Cybersecurity risks should never spread beyond a headline. Keep threats off your devices by downloading Malwarebytes today.
Introduction
This blog is
part of a cyber threat intelligence (CTI) blog series called Tracking
Adversaries that investigates prominent or new threat groups.
The focus of
this blog is EvilCorp, a sanctioned Russia-based cybercriminal enterprise known
for launching ransomware attacks, and RansomHub, a prominent ransomware as a
service (RaaS) operation run by Russian-speaking cybercriminals.These two threat groups have been linked together through cooperation on intrusions and IOCs and TTPs sha
This blog is
part of a cyber threat intelligence (CTI) blog series called Tracking
Adversaries that investigates prominent or new threat groups.
The focus of
this blog is EvilCorp, a sanctioned Russia-based cybercriminal enterprise known
for launching ransomware attacks, and RansomHub, a prominent ransomware as a
service (RaaS) operation run by Russian-speaking cybercriminals.
These two threat groups have been linked together through cooperation on intrusions and IOCs and TTPs shared by multiple CTI sources. The implication of this link is critical due to RansomHub being the most active ransomware gang and is working with a well-known sanctioned affiliate.
Who is RansomHub?
Active since
February 2024, RansomHub
is a RaaS operation formerly known as Cyclops and
Knight and is run by Russian-speaking adversaries. It is currently used by more and more cybercriminals that are ex-affiliates
of other RaaS operations. This includes the ALPHV/BlackCat RaaS and the LockBit
RaaS, which have since shutdown or disappeared. This has made the RansomHub RaaS one
of the most widespread ransomware families as of early 2025.
Due to
having a high number of affiliates, the tools and TTPs observed before the
final RansomHub payload is deployed can vary significantly.
Each affiliate may have their own set of tools and TTPs to achieve the final
objectives of data exfiltration and ransomware deployment.
Who is EvilCorp?
Evil Corp is
an international cybercrime network sanctioned for
orchestrating large-scale financial cyberattacks led by Maksim Yakubets. EvilCorp’s operations have evolved over time, expanding from Dridex
banking trojan campaigns into developing
ransomware like BitPaymer, WastedLocker, Hades, PhoenixLocker, and MacawLocker.
Notably,
Aleksandr Ryzhenkov, was identified
by the National Crime Agency (NCA) as a high-ranking member of EvilCorp and
also LockBit affiliate. Ryzhenkov became a LockBit affiliate around 2022, contributing to over 60
LockBit ransomware builds and attempting to extort more than $100 million from
victims. This discovery aligns with Mandiant’s previous reporting
on EvilCorp shifting to LockBit as well.
The NCA also
found that EvilCorp maintains close ties with Russian intelligence agencies
through Yakubets' father-in-law, Eduard Bendersky, a former FSB officer, who is
suspected of using his influence to shield the group from prosecution in Russia.
One of the
TTPs that makes EvilCorp standout from the rest of the RaaS affiliates is their
own affiliation
to the SocGholish
JavaScript malware (aka FAKEUPDATES). If ransomware deployment takes place
following a SocGholish infection, then the attackers responsible for the attack
will be affiliated with EvilCorp.
Reported Connections Between EvilCorp and RansomHub
On 15 July
2024, Microsoft shared a post on X stating that RansomHub was
observed being deployed in post-compromise activity by Manatee Tempest (which is Microsoft’s name for
EvilCorp) following initial access via SocGholish (aka FakeUpdates) infections
(which Microsoft tracks as Mustard Tempest).
On 15
January 2025, Guidepoint wrote a blog on a new Python backdoor used by an
affiliate of RansomHub. Notably, the new Python backdoor was delivered by
SocGholish. Therefore, this Python backdoor is another potential artifact worth
monitoring for its connection to known EvilCorp-related malware.
The next
day, on 16 January 2025, Google shared a report on EvilCorp (which Google tracks as
UNC2165) that disclosed numerous tools and malware families they have been using to deliver RansomHub, including a Python
backdoor dubbed VIPERTUNNEL (see the image below). The presence of a Python
backdoor following a SocGholish infection is notable TTP that overlaps with the
Guidepoint blog on RansomHub.
On 14 March
2025, Trend Micro disclosed further details that also confirmed the
SocGholish malware is leading to the deployment of RansomHub ransomware. The
operators of SocGholish are tracked as Water Scylla by Trend Micro. The
operators distribute SocGholish via the Keitaro Traffic Direction System (TDS), a legitimate service used for marketing campaigns. Trend Micro
also observed SocGholish dropping the same custom Python backdoor (aka
VIPERTUNNEL) as well.
So What?
EvilCorp has been under US sanctions since 2019, making it
illegal for affected organisations to pay ransoms to them without facing
potential fines from the US Treasury’s Office of Foreign Assets Control (OFAC).
Despite these sanctions, EvilCorp has continued its cybercriminal activities by
adapting its tactics to include rebranding their ransomware and becoming an affiliate of RaaS operations, such as LockBit and RansomHub.
The key indicator of EvilCorp's involvement in ransomware attacks continues to be the
use of the SocGholish malware, which employs drive-by downloads masquerading as web browser software updates to gain initial access to systems.
EvilCorp’s affiliation with RansomHub raises the
possibilities that RansomHub may soon face sanctions similar to those imposed
on EvilCorp. Consequently, any victim that pays a ransom to RansomHub could
become significantly riskier for cyber insurance organisations, incident
responders, and ransomware negotiators, as they may inadvertently violate
sanctions and face legal repercussions.
Given EvilCorp's prominence as a target for international
law enforcement, its association with RansomHub is likely to draw increased
scrutiny. This could result in RansomHub becoming the focus of future law
enforcement actions, including potential takedowns and additional sanctions,
further complicating the landscape for entities involved in ransomware response
and mitigation.
There is also the increased likelihood that RansomHub will
now rebrand. As we saw in the BlackBasta
Leaks, ransomware groups pay close attention to the news, CTI reports, and
even posts on X and even blogs by researchers. This association to EvilCorp and
threat of sanctions is an issue for ransomware groups as it impacts their
business model and makes earning harder. Therefore, by linking the two entities together CTI analysts can impose cost on these cybercriminals.
Entrar
