{ "Event": { "analysis": "1", "date": "2026-06-18", "extends_uuid": "", "info": "[Threat Intel] Operation Endgame vs. SocGholish Fake Updates", "protected": false, "publish_timestamp": "1782364288", "published": true, "threat_level_id": "3", "timestamp": "1782364288", "uuid": "0cb847d3-4247-4df8-990c-25e60867a1ce", "Orgc": { "name": "Rectifyq", "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4" }, "Tag": [ { "colour": "#0088cc", "local": false, "name": "misp-galaxy:producer=\"Infoblox\"", "relationship_type": "" }, { "colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": "" }, { "colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": "" }, { "colour": "#b94b1d", "local": false, "name": "rectifyq:mitre-att&ck=\"none-from-src\"", "relationship_type": "" }, { "colour": "#b94b1d", "local": false, "name": "rectifyq:mitre-att&ck=\"from-OTX\"", "relationship_type": "" }, { "colour": "#705cef", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Scheduled Task - T1053.005\"", "relationship_type": "" }, { "colour": "#e7d48a", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"System Owner/User Discovery - T1033\"", "relationship_type": "" }, { "colour": "#bb2745", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Standard Encoding - T1132.001\"", "relationship_type": "" }, { "colour": "#d3f567", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"JavaScript - T1059.007\"", "relationship_type": "" }, { "colour": "#aff0ae", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Permission Groups Discovery - T1069\"", "relationship_type": "" }, { "colour": "#47d9d3", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Malicious File - T1204.002\"", "relationship_type": "" }, { "colour": "#7d7034", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"System Information Discovery - T1082\"", "relationship_type": "" }, { "colour": "#75ec20", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Masquerading - T1036\"", "relationship_type": "" }, { "colour": "#36a9d8", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Account Discovery - T1087\"", "relationship_type": "" }, { "colour": "#91649a", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Virtual Private Server - T1583.003\"", "relationship_type": "" }, { "colour": "#0c0051", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"File and Directory Discovery - T1083\"", "relationship_type": "" }, { "colour": "#b76d96", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Registry Run Keys / Startup Folder - T1547.001\"", "relationship_type": "" }, { "colour": "#e08bb2", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Obfuscated Files or Information - T1027\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Exfiltration to Cloud Storage - T1567.002\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Security Software Discovery - T1518.001\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Drive-by Compromise - T1189\"", "relationship_type": "" }, { "colour": "#92e858", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Web Protocols - T1071.001\"", "relationship_type": "" }, { "colour": "#dedf36", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Domains - T1584.001\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:malpedia=\"FAKEUPDATES\"", "relationship_type": "" }, { "colour": "#49a260", "local": false, "name": "rectifyq:category=\"threat\"", "relationship_type": "" }, { "colour": "#130049", "local": false, "name": "rectifyq:sub-category=\"campaign-analysis\"", "relationship_type": "" }, { "colour": "#150050", "local": false, "name": "rectifyq:sub-category=\"report\"", "relationship_type": "" }, { "colour": "#ffd12e", "local": false, "name": "rectifyq:target=\"broad-based\"", "relationship_type": "" }, { "colour": "#55acee", "local": false, "name": "rectifyq:MY-relevancy=\"potentially-relevant\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:threat-actor=\"GOLD PRELUDE\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#3800d9", "local": false, "name": "rectifyq:action-taken=\"VT-comment\"", "relationship_type": "" }, { "colour": "#3d00e9", "local": false, "name": "rectifyq:action-taken=\"telegram\"", "relationship_type": "" } ], "Attribute": [ { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1781838011", "to_ids": false, "type": "link", "uuid": "301765ec-480d-443b-af6e-503a32e7e0d3", "value": "https://www.infoblox.com/blog/threat-intelligence/hot-take-operation-endgame-vs-socgholish/" }, { "category": "Other", "comment": "Description", "deleted": false, "disable_correlation": false, "timestamp": "1781838011", "to_ids": false, "type": "text", "uuid": "f69f4688-c142-43fd-838a-4919cf8b9427", "value": "A multinational law enforcement operation called Operation Endgame has successfully disrupted SocGholish, a malware framework operated by threat actor TA569 since 2017. The operation took down 106 servers and domains and remediated nearly 15,000 compromised WordPress websites. SocGholish uses fake browser update prompts on compromised websites to trick victims into downloading malicious JScript payloads, providing initial access to corporate networks for ransomware deployment and data breaches. Analysis revealed that 55% of Infoblox cloud customers were exposed to SocGholish in 2026, demonstrating widespread impact across multiple industries including government, education, and healthcare. The framework employs domain shadowing techniques and operates through a four-stage attack chain involving traffic acquisition, filtering, fake update lures, and on-device implant execution. SocGholish infrastructure has facilitated access for various ransomware families and has been extensively used by the notorious Evi..." }, { "category": "Other", "comment": "Summary", "deleted": false, "disable_correlation": false, "timestamp": "1781838011", "to_ids": false, "type": "text", "uuid": "0a555ec1-316e-43f4-a421-27e47dfdff59", "value": "Name: Operation Endgame vs. SocGholish Fake Updates\nAuthor: AlienVault\nAdversary: GOLD PRELUDE\nTags: [\"venomrat\", \"smokeloader\", \"pikabot\", \"evilcorp\", \"wordpress compromise\", \"operation endgame\", \"bumblebee\", \"traffic distribution system\", \"rhadamanthys\", \"danabot\", \"icedid\", \"qakbot\", \"initial access broker\", \"fake updates\", \"domain shadowing\", \"doppelpaymer\", \"hades\", \"ransomhub\", \"socgholish\", \"trickbot\", \"wastedlocker\", \"lockbit\"]\nTgtd countries: []\nMlwr families: [\"SocGholish\", \"IcedID - S0483\", \"Smokeloader\", \"Pikabot\", \"Bumblebee - S1039\", \"QakBot - S0650\", \"Pinkslipbot\", \"QuackBot\", \"QBot\", \"DanaBot\", \"TrickBot - S0266\", \"Totbrick\", \"TSPY_TRICKLOAD\", \"Rhadamanthys\", \"VenomRAT\", \"DoppelPaymer\", \"WastedLocker - S0612\", \"Hades\", \"LockBit\", \"RansomHub\"]\nAttack_ids: [\"T1053.005\", \"T1033\", \"T1132.001\", \"T1059.007\", \"T1069\", \"T1204.002\", \"T1082\", \"T1036\", \"T1087\", \"T1583.003\", \"T1083\", \"T1547.001\", \"T1027\", \"T1567.002\", \"T1518.001\", \"T1189\", \"T1071.001\", \"T1584.001\"]\nIndustries: [\"Government\", \"Education\", \"Finance\", \"Healthcare\", \"Hospitality\", \"Technology\"]" }, { "category": "Attribution", "comment": "Adversary", "deleted": false, "disable_correlation": false, "timestamp": "1782344713", "to_ids": false, "type": "threat-actor", "uuid": "18ea43ed-6810-44fd-a9ec-7c31f1ca7dbe", "value": "TA569", "Tag": [ { "colour": "#0088cc", "local": false, "name": "misp-galaxy:threat-actor=\"GOLD PRELUDE\"", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782354997", "to_ids": true, "type": "hostname", "uuid": "46df41c9-35c4-4d14-a195-05b265dc80b5", "value": "trademark.iglesiaelarca.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782355018", "to_ids": true, "type": "hostname", "uuid": "22ac31d1-623d-46f4-957f-0e31030e02d9", "value": "content.garretttrails.org", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782355039", "to_ids": true, "type": "hostname", "uuid": "4006f99e-9249-49a5-8e7c-fb3cf33d90cc", "value": "promo.summat10n.org", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782355060", "to_ids": true, "type": "hostname", "uuid": "d4e875e9-45aa-474e-9de4-d5f1aebaf10e", "value": "billing.roofnrack.us", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782355081", "to_ids": true, "type": "hostname", "uuid": "65cfdfe1-c6fd-4b0e-b8c8-3c265c951b60", "value": "devel.asurans.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782355102", "to_ids": true, "type": "hostname", "uuid": "3d82ad84-6b8e-4ee3-8740-3197e09730b1", "value": "storehouse.beautysupplysalonllc.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782355123", "to_ids": true, "type": "hostname", "uuid": "9d64a6df-0a55-46df-a967-31675bd2b114", "value": "samples.addisgraphix.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782355145", "to_ids": true, "type": "hostname", "uuid": "06d9c6c3-bf1a-4f34-b929-372062ce6cc4", "value": "api-app.uppercrafteroom.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782355166", "to_ids": true, "type": "hostname", "uuid": "accf9159-fd5d-4cbe-98bf-6bfe6541bfb4", "value": "pa-portal.benningtonspringsmhp.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782355187", "to_ids": true, "type": "hostname", "uuid": "1a9f84c0-ebc0-4a88-9145-6f148d9c5daa", "value": "shop.steadycompanion.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782355208", "to_ids": true, "type": "hostname", "uuid": "30eb8097-c90b-4633-aa49-e05e643ca117", "value": "platform.exathomeswebuyarizona.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782355231", "to_ids": true, "type": "hostname", "uuid": "9c6ef0ae-8302-4bde-add7-3abeabb969ea", "value": "app-front.anmaradigital.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] } ] } }