Operation Endgame: Disrupting SocGholish and Securing WordPress Infrastructure

In a significant coordinated effort, Dutch law enforcement authorities alongside counterparts from Canada, Germany, and the U.S., have successfully disrupted the malicious infrastructure underpinning the SocGholish malware campaign. As part of "Operation Endgame," authorities cleaned approximately 15,000 infected WordPress sites that were serving as the primary distribution vector for this threat.

SocGholish (often tracked as FakeUpdates) is a pervasive JavaScript-based downloader that relies on compromised websites to deliver its payload. By seizing these servers, authorities have deprived cybercriminals of critical access points used to infect end-user systems. However, while this takedown is a major victory, the SocGholish threat actors are resilient. History shows that botnets often rebuild infrastructure rapidly. Defenders must act now to identify if their assets are part of the residual botnet or if their endpoints have been targeted by this campaign.

Technical Analysis

The Threat Vector

SocGholish operates primarily as a "drive-by" downloader. The attack chain begins with the compromise of a legitimate WordPress website, typically via vulnerable plugins, themes, or stolen credentials. Once the site is compromised, attackers inject malicious JavaScript tags, often masquerading as legitimate analytics or jQuery libraries.

Payload Delivery (Fake Browser Updates)

The injected script checks the visitor's browser and user agent. If the target matches the threat actor's criteria, the site displays a fake "Update Your Browser" overlay. This is a social engineering tactic designed to trick the user into downloading a malicious file (e.g., update.js, chrome_setup.exe) under the guise of a critical browser update.

Execution and Impact

Once the user executes the downloaded file, SocGholish acts as a loader. It establishes a command-and-control (C2) channel and downloads secondary payloads, which frequently include Cobalt Strike beacons, information stealers (like RedLine), or ransomware droppers. The takedown of 14,971 WordPress sites significantly reduces the surface area for this initial access vector, but endpoints that have already been infected remain compromised.

Affected Platforms

Distribution Servers: Linux-based WordPress hosting environments (cPanel, Plesk, vanilla LAMP stacks).
Victim Endpoints: Primarily Windows workstations executing the fake update payload.

Detection & Response

Given the scale of this infrastructure takedown, security teams must hunt for both the web-shells compromising the servers and the loaders executing on endpoints.

SIGMA Rules

YAML

---
title: Potential SocGholish Fake Browser Update Execution
id: 8a2b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects execution of JavaScript files via wscript.exe or mshta.exe initiated by a web browser, a common TTP for SocGholish (FakeUpdates) payload delivery.
references:
  - https://securityarsenal.com/blog/operation-endgame-socgholish
author: Security Arsenal
date: 2026/06/02
tags:
  - attack.execution
  - attack.t1059.007
  - attack.initial_access
  - attack.t1189
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
      - '\chrome.exe'
      - '\firefox.exe'
      - '\msedge.exe'
      - '\opera.exe'
    Image|endswith:
      - '\wscript.exe'
      - '\mshta.exe'
    CommandLine|contains: '.js'
  condition: selection
falsepositives:
  - Legitimate web-based applications utilizing local scripting
level: high
---
title: Suspicious JavaScript Download to Webroot
id: 1f2e3d4c-5b6a-7d8e-9f0a-1b2c3d4e5f6a
status: experimental
description: Detects wget or curl downloading common SocGholish payload filenames (jquery.js, update.js) into the web root directory.
references:
  - https://securityarsenal.com/blog/operation-endgame-socgholish
author: Security Arsenal
date: 2026/06/02
tags:
  - attack.initial_access
  - attack.t1190
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    Image|endswith:
      - '/wget'
      - '/curl'
    CommandLine|contains:
      - '/var/www/html'
      - '/public_html'
    CommandLine|contains:
      - 'jquery.js'
      - 'update.js'
      - 'chrome.js'
  condition: selection
falsepositives:
  - Legitimate developer or admin operations
level: medium

KQL (Microsoft Sentinel / Defender)

KQL — Microsoft Sentinel / Defender

// Hunt for SocGholish Fake Update activity on endpoints
DeviceProcessEvents
| where InitiatingProcessFileName in ("chrome.exe", "firefox.exe", "msedge.exe", "opera.exe")
| where FileName in ("wscript.exe", "mshta.exe")
| where ProcessCommandLine contains ".js"
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, FileName, ProcessCommandLine
| order by Timestamp desc

Velociraptor VQL

VQL — Velociraptor

-- Hunt for SocGholish related JavaScript files in user directories or web roots
SELECT FullPath, Size, Mtime, Mode
FROM glob(globs='/*/Downloads/*.js')
WHERE Name =~ 'jquery' OR Name =~ 'update' OR Name =~ 'chrome'
  OR FullPath =~ '/var/www/html.*\.js'

Remediation Script (Bash)

Use this script on suspected compromised WordPress servers to identify common SocGholish persistence mechanisms.

Bash / Shell

#!/bin/bash
# Remediation script to check for common SocGholish indicators on WordPress servers
WEB_ROOT="/var/www/html"
INDICATORS=("jquery.js" "update.js" "chrome.js" "core.php")

echo "[+] Scanning for SocGholish indicators in $WEB_ROOT..."

for file in "${INDICATORS[@]}"; do
  find "$WEB_ROOT" -name "$file" -type f -exec ls -lh {} \; 2>/dev/null
done

echo "[+] Checking for obfuscated base64 code in PHP files..."
find "$WEB_ROOT" -name "*.php" -type f -exec grep -l "eval(base64" {} \; 2>/dev/null

echo "[+] Checking wp-config.php for suspicious injections..."
if [ -f "$WEB_ROOT/wp-config.php" ]; then
  grep -i "include\|require" "$WEB_ROOT/wp-config.php" | grep -v "wp-settings"
fi

Remediation

WordPress Cleanup: If your server was identified as infected (or you suspect it):
- Restore from Backup: The most reliable method is restoring the WordPress core and database from a backup created before the compromise date.
- Update All Components: Ensure WordPress core, all plugins, and themes are updated to the latest versions.
- Remove Unknown Admins: Check the wp_users table for unauthorized administrator accounts.
- Integrity Check: Use tools like wp-cli to verify core file checksums against the official repository.
Endpoint Hardening:
- Application Whitelisting: Prevent wscript.exe and mshta.exe from executing JavaScript files downloaded from the Internet.
- User Education: Remind users that browsers update automatically via built-in mechanisms and never require manual execution of .js or .exe files from pop-ups.
Monitoring:
- Implement the Sigma rules provided above to alert on future infection attempts, as residual infrastructure or copycat actors may attempt to revive the campaign.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub