Threats Tagged 'qbot'

Operation Endgame is a multinational law enforcement effort that disrupted the SocGholish malware framework, which has been active since 2017. SocGholish compromises WordPress websites and uses fake browser update prompts to trick users into downloading malicious JScript payloads. This initial access vector facilitates ransomware deployment and data breaches across multiple industries including government, education, and healthcare. The malware employs domain shadowing and a four-stage attack chain involving traffic acquisition, filtering, fake update lures, and implant execution. The operation took down 106 servers and domains and remediated nearly 15,000 compromised sites. Analysis showed that 55% of Infoblox cloud customers were exposed to SocGholish in 2026, indicating widespread impact. The infrastructure has been used by multiple ransomware families and threat actors. No specific software versions are affected, and no known exploits in the wild are reported.