Joint operation disrupts SocGholish infrastructure and cleans ~15,000 WordPress sites

Intelligence Summary

Dutch authorities disrupted malicious infrastructure tied to SocGholish with help from Canada, Germany, and the U.S. The coordinated action also led to cleanup of nearly 15,000 compromised WordPress sites. By taking control of parts of the infrastructure, investigators aim to deny criminals access to infected systems. This reduces the ability of these servers to participate in further malicious activity. Site owners running affected WordPress instances should ensure they are fully patched and free of compromise.

Recommended Action

Review affected assets, schedule urgent remediation, and monitor related indicators.

Topics