Authorities disrupt Evil Corp’s SocGholish botnet

Multinational law enforcement agencies, with private-sector partners, disrupted the SocGholish/FakeUpdates botnet and seized infrastructure used to redirect victims via traffic distribution systems (TDS). The operation took down 106 servers, remediated nearly 15,000 infected sites (primarily WordPress), disabled the botnet, and alerted victims; the malware is tied to Evil Corp and has been used to enable multiple ransomware families and other criminal activity.