A multinational law enforcement action, part of Operation Endgame, has disrupted SocGholish, a notorious malware framework known for fake updates that provides initial access to other cybercriminals, including EvilCorp. This week, law enforcement and private-industry partners have taken down 106 servers and domains and remediated 14.971 compromised WordPress websites. These websites fuel SocGholish’s fire.
Infoblox Threat Intel is proud to be a partner in Operation Endgame. We believe that government-industry partnerships are both necessary and effective in combating cybercrime. SocGholish is used to target the very networks that we seek to protect. Modern data breach attacks rarely begin with ransomware: they begin with access, and SocGholish has played a major part in initial access for nearly a decade. This week Operation Endgame has dealt a major blow to TA569 by disrupting their SocGholish infrastructure and abolishing major sources of victim traffic.
The effective control of tens of thousands of websites is not just a number. We found that nearly 55% of our cloud customers were exposed to SocGholish in 2026, demonstrating the true potential impact of the threat on enterprises and institutions worldwide. Our customer base not only has our protective DNS but typically also uses other defenses in their security arsenal. As a result, although the exposure to SocGholish was high, only a small number of customers appear to have progressed through to the final stage of the attack.
Even with layered defenses, it only takes a single compromised device in a network to enable a data breach. Many organizations do not have sufficient protection from SocGholish and the criminals within the SocGholish ecosystem have proven their skills for nearly a decade. This is why disruption efforts like those of Operation Endgame matter.
In this blog, we will explain how SocGholish operates and detail our analysis of the threat based on visibility at our DNS resolvers.
What is Operation Endgame?
Operation Endgame was first announced in 2024 as a coordinated international law-enforcement campaign aimed at dismantling the infrastructure that underpins cybercrime at scale. What makes it especially relevant for defenders is its focus on the earlier stages of the intrusion chain. Rather than only pursuing the actors who deploy ransomware or extort victims at the end of an intrusion, Endgame targets the services that facilitate those crimes: droppers, loaders, botnets, traffic distribution systems (TDSs), and access-enabling malware.
Earlier “seasons” of Operation Endgame focused on known malware families such as IcedID, Smokeloader, Pikabot, Bumblebee, QakBot, DanaBot, TrickBot, and, most recently in November 2025, the Rhadamanthys infostealer, VenomRAT, and the Elysium botnet. Like SocGholish, these previous targets are part of the service economy that enabled major intrusions and data breaches.
Crucially, much of Operation Endgame’s success also rests on its deep collaboration with private industry. Cybersecurity firms including Proofpoint, CrowdStrike, Microsoft, Bitdefender, ESET, Shadowserver, Spamhaus, Spycloud, Have I Been Pwned, and with this latest iteration, Infoblox, have contributed threat intelligence, infrastructure analysis, and victim remediation support, making Operation Endgame a successful model for how public-private partnership can disrupt cybercrime at scale.
Why Does it Matter?
SocGholish is one of the longest operating web-inject frameworks known. First observed in 2017 and publicly documented in 2018, it uses compromised websites to show fake browser update prompts to website visitors and trick them into downloading a malicious JScript payload.
The threat actor operating the SocGholish framework is TA569, also tracked as Mustard Tempest, Gold Prelude, or UNC1543. TA569 operates as a so-called initial access broker, which means that their main objective is the compromise of devices connected to a company-managed network environment with the objective of obtaining elevated access to corporate networks. This access is then sold off or handed over to other actors who leverage it to deploy additional malware, including ransomware, and use the access for extortion or data exfiltration.
SocGholish-related initial access has been tied to over half a dozen ransomware families including DoppelPaymer, WastedLoocker, Hades Ransomware, LockBit, RansomHub and more. Additionally, since its earliest days, the SocGholish framework has been used by one of the most notorious Russian cybercrime conglomerates: EvilCorp. A June 2022 report by Mandiant stated that UNC2165, their moniker for EvilCorp, almost exclusively obtained initial access from TA569’s SocGholish. Action against SocGholish will impact EvilCorp as well as others.
How Does the SocGholish Framework Work?
SocGholish is a multi-stage Javascript framework used to convert compromised websites into drive-by download malware distribution vectors. These sites are often powered by WordPress. While sites may be vulnerable to different attacks, many compromises are accomplished through leak credentials. Operation Endgame found 1.4M leaked website credentials that could be used by SocGholish and other actors to infect systems.
The framework consists of four stages: traffic acquisition, traffic filtering, payload lures, and on-device implant execution. We will briefly describe each stage, focusing on the most important aspects from an Infoblox perspective.
Stage 1: Traffic Acquisition
The first step is to acquire website traffic. TA569 compromises a very large number of websites themselves: within the research community, it’s believed they could have controlled a million sites during their history. But they also accept traffic from affiliates. It’s a classic commercial relationship: when a user visits the site, the affiliate typically fingerprints them and then passes potential victims to SocGholish through an embedded link. In return, the affiliate will be paid for these “leads.” We consider these initial links to be the tier one infrastructure of the attack framework.
A typical tier one link seen during recent years would look like this (Figure 1):
<subdomain.domain.tld/<loooooongbase64string>
Figure 1. An example of a tier one SocGholish link used to deliver potential victims for further processing
However, when looking back further at the initial days of SocGholish, it would look like this (Figure 2):
<subdomain.domain.tld/<filename>.js?cid=<int>&v=<random alphanumeric string>
Figure 2. An example of a historical tier one SocGholish link used to deliver potential victims for further processing (source Malwarebytes)
People familiar with TDSs might recognize this pattern. The parameter “cid” is commonly referred to as a “client id” or “campaign id” and is commonly used in campaigns to attribute incoming traffic to a specific traffic provider or advertising campaign in affiliate advertising.
SocGholish is set up in the exact same way. Different traffic providers embed the tier one link into compromised pages. Once the traffic reaches the tier one infrastructure, SocGholish takes over, filters the traffic and presents each visitor with a tailored payload. It is largely believed that the long base64 string observed in the later years of this operation still contains similar information; however, there is now a layer of encryption added that prevents reading those parameters.
Because of the affiliate nature of SocGholish, one of the hardest parts of tracking the threat over the years was not identifying the fake update lure itself. It was tracking the many actors and systems that fed traffic into it and understanding how those sources changed over time.
Many affiliates have sold traffic to the SocGholish framework over the years, most notably TA2726, ParrotTDS, and more recently, a TDS that we and threat researcher Randy McEoin have dubbed JunkyTDS. Multiple actors have utilized the commercial Keitaro tracker, zTDS and similar TDS frameworks to filter traffic for redirection to SocGholish. When the visitor to the compromised site did not match the criteria for SocGholish, they were either shown the original website or redirected to other content from which the affiliate could profit. See Figure 3.
Figure 3. A simplified view of affiliates that drive potential victims to SocGholish.
Stage 2: Traffic Filtering
After the infected website redirects to the SocGholish TDS, the attack typically proceeds to the second stage: a fingerprinting script. As is common with TDS actors or those working with web traffic for drive-by downloads, the goal is to ensure that malicious payloads are only delivered to genuine victims. To do so, they filter out bots, security researchers, and devices outside SocGholish’s target profile. The fingerprinting stage is an evasion mechanism that runs several checks in sequence. WordPress admins and anyone who has already executed the payload are excluded, so they don’t receive it again. Visitors on an automated browser are redirected to one type of payload. Visitors with an unusually small screen—a sign of a mobile phone or certain sandbox environments—are redirected to a second type of payload. These two payloads are used only for logging endpoints.
Only users who meet all the criteria are shown a fake update message.
Stage 3: Fake Update Prompts
The fake update template is presented to the website visitor from the same tier one infrastructure as the fingerprinting script. It is important to realize that for the entire process, the victim is never diverted from the infected page they wanted to visit initially. The fake update template gets loaded within the same page the visitor wanted to see: it forcefully deletes the original content and replaces it with the template. This makes the fake update request more believable, since the update seems to be rendered while opening a trusted website, rather than through a shady redirect flow.
To get the best coverage and make the lure more convincing, SocGholish can present different templates fitting the style and layout of all major browsers. An example of such a template and the downloaded payload file can be seen in Figure 4.
Figure 4. SocGholish Fakeupdate template triggered in Firefox on June 11, 2026
Once the victim hits the “Download” button, the fake update template reaches out to the tier one server again, downloading a premade payload via an iframe injection. This way, the payload is not downloaded from an external server but from the compromised domain the user intended to visit.
Stage 4: On-Device Stager
In recent years, SocGholish has used the fake update flow to trick victims into executing a deceptively simple, custom-made JScript file on their endpoint. Jscript is Windows own “interpretation” of ECMA Script, which is the same foundation JavaScript was built on.
While most other actors are currently relying on large, heavily obfuscated scripts that can often be several hundred if not thousands of lines of code, a reformatted SocGholish stager only consists of about 6 lines of code, shown in Figure 5.
Figure 5. Deobfuscated SocGholish JScript payload downloaded via the SocGholish fake update template
In short, the code creates an ActiveXObject, sends a base64 string to a hardcoded command-and-control (C2), then expects a response that will be directly executed as a new function.
The hardcoded domains within the SocGholish stager can be understood as tier two hostnames. Unlike the tier one hostnames that are operated over a long period of time, the tier two hostnames change several times per week. This presents a unique challenge to defenders because the actor uses a technique called domain shadowing, which we will discuss in the following section.
After execution of the JScript stager, the next stages depend on the victim device and how valuable it appears to the operators. That assessment is made through follow-up fingerprinting scripts or loaders delivered by the stager. In this context, domain-joined systems, that is, ones connected to a central directory service, are especially valuable because they are connected to a corporate identity and management environment, making them far more useful as an entry point into a wider enterprise network. Since SocGholish’s primary purpose is to obtain and sell initial access to corporate environments, those systems are more likely to receive follow-on tooling intended to support deeper intrusion activity, data theft, or ransomware deployment. Lower-value systems, by contrast, such as devices that are not joined to a corporate domain, are commonly monetized through off-the-shelf infostealer malware.
Domain Shadowing
One thing that makes SocGholish especially interesting is its use of domain shadowing for both the tier one and tier two hostnames. Domain shadowing is a technique in which threat actors gain access to the authoritative DNS provider or registrar account for a legitimate domain and then use that access to create rogue subdomains beneath it for nefarious purposes.
For attackers, this offers several clear advantages. The malicious hostnames inherit the age, reputation, and apparent legitimacy of the parent domain, which can make them look benign at first glance and reduce the likelihood of immediate blocking. A defender investigating an alert may see a hostname under a long-established business domain and initially assume it is legitimate, even though the subdomain itself was created solely for malicious activity. In addition, the creation of new subdomains is often monitored less closely than the registration of entirely new domains, making shadowed infrastructure harder for defenders and threat intelligence products to identify early.
In the SocGholish ecosystem, this technique fits naturally into a broader operating model built around traffic redirection, layered delivery, and rapid infrastructure churn. To make matters even harder for defenders, SocGholish rotates the shadowed tier two domains at high frequency, ranging from daily rotation to at least once per week. That rapid turnover amplifies all of the technique’s existing advantages: it shortens the time defenders have to identify and investigate rogue subdomains, reduces the usefulness of static blocklists, and allows the actor to refresh trusted-looking C2 infrastructure before many defenders can confidently classify and respond to it.
While the classification of who provided the traffic is difficult, defenders have one advantage when it comes to blocking attacks by SocGholish. It boils down to the fact that a multi-stage architecture also can be blocked at multiple stages. We leverage several ways to achieve that, which we showcase in the graph in Figure 6 below.
Figure 6. A view of how blocking resolution of domains impacts the SocGholish attack chain
In practice, defenders can disrupt SocGholish at several points along the attack chain. Infoblox Threat Intel attempts to track and detect:
- Compromised websites (traffic source)
- Domains associated with webinject and traffic-redirection actors, including TA2726 and other TDS operators that feed traffic into SocGholish campaigns (tier one)
- SocGholish tier one and tier two hostnames (tier two)
These detections are then available in Threat Defense for customers to prevent resolution of the domains. Blocking tier one infrastructure interrupts the attack before the fake update chain can fully develop. Blocking tier two infrastructure prevents the JScript stager from reaching its next-stage server. This distinction is important for the following section, where we analyze queries to tier one and tier two hostnames across our customer networks: any traffic blocked through our compromised domain or TDS detection processes is stopped before it ever reaches those later stages and therefore the subsequent domains do not show up at our DNS resolvers.
Infoblox Customer Network Impacts
From an Infoblox perspective, SocGholish brought together several of the DNS-centric themes that matter most in our research. On one hand, the ecosystem directly overlapped with our earlier work on TDSs and traffic suppliers, including actors such as TA2726 and the broader use of Keitaro by SocGholish-affiliated traffic providers. On the other hand, it relied on one of the more challenging infrastructure techniques for defenders to track at scale: rapidly rotating shadowed tier two hostnames created under legitimate parent domains. Taken together with the sheer volume of compromised websites feeding traffic into the ecosystem, these characteristics made SocGholish tier one infrastructure one of the most consistently observed web-based threats in our customer networks. To understand the full impact of the actor, it is therefore useful to shift from how SocGholish operated, to what its scale, prevalence, and distribution looked like from our vantage point.
To get a feeling for how large the impact within our customer networks has been so far, we collected a list of 86 tier one hostnames related to the SocGholish framework. Note that those are the domains that are either directly injected into a website or part of the multi-layer traffic provider infrastructure that builds compromised sites. The following numbers therefore represent attacks against our customers, but not successful compromise of an endpoint device.
More than 54% of our Threat Defense cloud customer networks attempted to resolve one of those SocGholish tier one domains between January 1st and May 30th. Table 1 shows the domains that were observed most frequently.
| SocGholish Tier One Hostname | Resolution Attempts |
|---|---|
| pa-portal[.]benningtonspringsmhp[.]com | 3,187 |
| billing[.]roofnrack[.]us | 799 |
| storehouse[.]beautysupplysalonllc[.]com | 761 |
| promo[.]summat10n[.]org | 644 |
| shop[.]steadycompanion[.]com | 561 |
| samples[.]addisgraphix[.]com | 549 |
| app-front[.]anmaradigital[.]com | 449 |
| trademark[.]iglesiaelarca[.]com | 341 |
| content[.]garretttrails[.]org | 314 |
| api-app[.]uppercrafteroom[.]com | 274 |
Table 1. The most commonly seen SocGholish tier one domains in Infoblox Threat Defense cloud customer networks between January 1, 2026 and May 30, 2026
In contrast, Table 2 below highlights which tier one hostnames had the broadest customer impact.
| SocGholish Tier One Hostname | Customers Querying Hostname |
|---|---|
| pa-portal[.]benningtonspringsmhp[.]com | 35% |
| billing[.]roofnrack[.]us | 14% |
| storehouse[.]beautysupplysalonllc[.]com | 13% |
| samples[.]addisgraphix[.]com | 13% |
| shop[.]steadycompanion[.]com | 11% |
| app-front[.]anmaradigital[.]com | 11% |
| trademark[.]iglesiaelarca[.]com | 10% |
| api-app[.]uppercrafteroom[.]com | 7% |
| devel[.]asurans[.]com | 5% |
| platform[.]exathomeswebuyarizona[.]com | 5% |
Table 2. Most seen SocGholish tier one domains by customer reach between January 1, 2026 and May 30, 2026
The fact that pa-portal.benningtonspringsmhp[.]com is so broadly observed in terms of both requests and customer impact is noteworthy. It is one of the newest SocGholish tier one hostnames in our dataset and was set up in February 2026. This stands in contrast to the second-most seen domain: billing.roofnrack[.]us, which was first observed in July 2025, almost a year ago.
These observations might indicate that TA569 or one of their affiliates carried out a large-scale infection campaign at the beginning of 2026 to establish the new domain.
Figure 7 below shows a graph highlighting the daily queries observed to SocGholish tier one hostnames from within our customer networks.
Figure 7. Volume of DNS queries for SocGholish tier one hostnames seen at Infoblox Threat Defense resolvers; these patterns demonstrate fairly low volume and “seasonality” expected for work week activity
Based on our telemetry, the highest number of requests was on January 15, when we recorded 187 queries. In contrast, May 16 marked the lowest level of activity, with only a single customer request observed. More notable, however, is the overall distribution of requests across the week. The pattern is consistent: requests to SocGholish domains rise at the start of the work week, remain elevated on business days, and then drop to nearly zero over the weekend.
Given that SocGholish is a web inject actor, this pattern is intuitive. As employees return to work on Monday and resume normal web browsing, the likelihood of visiting compromised websites increases, which in turn increases the number of queries at our resolvers. Activity remains elevated through the week before tapering off toward Friday as workdays end across time zones. By Saturday and Sunday, when far fewer employees are browsing from corporate environments, the volume of observed attack traffic almost disappears.
Similarly, the impact of SocGholish by industry sectors shows that there is no clear targeting of specific industries. Almost every industry sector has observed at least one SocGholish domain query over the past 5 months. The strongest concentration was observed in Government, Education, Banking, Healthcare, and Non-IT Services; see Figure 8.
Figure 8. SocGholish queries observed by industry January – May 2026
This distribution in Figure 8 reinforces that SocGholish is not a niche threat limited to one vertical. Instead, its large-scale webinject and TDS ecosystem reaches into both public-sector and commercially important environments, making it a broadly relevant threat across our customer base.
At the same time, these figures should be read with a few important caveats in mind. First, every observed DNS query in our dataset also means that the threat was seen by our security stack and, depending on the customer’s configuration, likely has been blocked before any connection to a SocGholish TDS server could be established. Second, the domains analyzed in this section are webinject domains. While they provide a useful measure of the scale of the SocGholish ecosystem, not all of them were actively operated throughout the full analysis period.
Of the 86 domains we reviewed, only 32 were observed within the timeframe of this analysis and therefore meaningfully inform the findings presented here. Many of the remaining domains had already been dormant for months at the time of writing. However, the fact that TA569 configured SocGholish not to respond to certain tier one domains or even discontinued the use of them altogether, does not change the underlying reality that these hostnames remained embedded in compromised websites. As a result, the volume of DNS requests we observed for tier one domains is also driven by the large number of compromised websites continuing to reach out to this infrastructure, even after the actors themselves had already moved on from parts of it.
We extended our tier one analytic approach to SocGholish’s tier two infrastructure, collecting hostnames observed across the same period—the first five months of 2026. Tier two infrastructure refers to the hostnames contacted by the JScript stager upon execution on a victim’s device. Unlike tier one, contact with a tier two hostname indicates a compromise attempt that has progressed past the initial web-injection stage. During this period we identified 97 such hostnames.
The results were striking. While we observed more than 500 customer networks reaching out to SocGholish tier one infrastructure, only a handful of customer networks queried tier two hostnames within the same timeframe. This large difference is important, but it should be interpreted carefully. Part of the gap is almost certainly explained by security controls: many customers may have detected and blocked the threat before traffic ever reached the next stage, with our own products being part of this defense architecture. In addition, tier one activity reflects exposure to compromised websites at scale, whereas tier two activity is a much narrower signal that suggests a victim executed the JScript stager on an endpoint device. In other words, the large number of tier one observations highlights how broadly the ecosystem reached into corporate networks, while the much smaller number of tier two contacts shows that only a small fraction of those exposures appears to have progressed to a later stage of the infection chain.
Even so, the small number of observed tier two contacts should not lead defenders to underestimate the threat. SocGholish only needs a single successful execution inside a corporate network to establish an initial foothold for follow-on compromise. At the same time, our impact analysis shows that the affected organizations were far from low value: three belonged to the government sector, two to the hospitality sector, and one operated in critical infrastructure. In other words, while relatively few customer networks were seen progressing to this later stage of the infection chain, those that did were exactly the kind of targets defenders should be most concerned about.
Summary and Outlook
For the last nine years, SocGholish, operated by TA569, has posed a major threat to enterprise organizations around the world. As our own analysis shows, nearly 55% of the customer networks in our dataset attempted to reach SocGholish infrastructure during a five-month period. While the overwhelming majority of those attempts did not progress to an active device compromise, we still identified a small number of customer networks potentially impacted by on-device execution of a SocGholish payload.
Our data also showed exposure to the threat crossed industries. This underlines an important point: SocGholish was not a niche threat confined to one vertical, but a large-scale web-based access ecosystem with broad reach into corporate and institutional networks.
Against that backdrop, the law enforcement measures unveiled today were both timely and necessary. The figures shared by law enforcement on the scale of WordPress compromise tied to TA569 and its affiliates are remarkable, and they provide a rare glimpse into the true scale that mature web-compromise operations can reach.
In the coming weeks, we expect sightings of SocGholish activity to decline. Operation Endgame likely disrupted central parts of TA569’s operation and may have dealt a serious blow to its reputation as a reliable initial-access provider. Even if some parts of the infrastructure persist, the operation has likely introduced significant friction for both TA569 and the traffic suppliers that supported it.
The key question now is if and how quickly the actors can adapt: whether they attempt to rebuild the existing ecosystem, shift to alternative infrastructure, or move on to new delivery models.
That uncertainty also applies to the broader traffic supplier layer. While actors such as TA2726 have previously shown that they can pivot between multiple monetization schemes, others, including the operators behind ParrotTDS, have not previously been observed delivering any alternative attacks than SocGholish. For defenders, this makes the post-operation period especially important to watch.
Infoblox Threat Intel will continue tracking how this ecosystem evolves, whether old partnerships re-emerge, and what new infrastructure or delivery chains may take shape in response.
Check out the Endgame video here: https://www.operation-endgame.com/videos/S03E03_SOCGHOLISH.mp4
