RCMP leads Canadian side of Endgame strike on SocGholish malware
The RCMP says its Vancouver cybercrime team led Canada's part in an Operation Endgame action against SocGholish, a malware framework linked to the Russian cybercrime group Evil Corp, which spread through thousands of hijacked WordPress websites. The RCMP announced the results June 18.
SocGholish is a common first step in serious intrusions. It shows visitors to compromised sites a fake browser update; people who install it give attackers a foothold that can lead to data theft or ransomware. Insp. Kurt Bedford said the malware "has had an impact on all levels of Canadian society," including critical infrastructure, education and government.
What happened
According to the RCMP release, Dutch police, the RCMP, the FBI and Germany's BKA led the action during a joint global action week, with Denmark, France, the United Kingdom, Belgium and Australia also part of Operation Endgame and Europol and Eurojust supporting.
The Cybercrime Investigation Team in Vancouver, part of Federal Policing Pacific Region, assigned coders, analysts, investigators and project managers to the project. Using information from Dutch police, the team developed a disruption technique against SocGholish that partners then refined. The RCMP said 2,488 computers were disinfected worldwide and 14,971 websites were actioned, and that the technique is designed to stop SocGholish from re-infecting the cleaned sites. All compromised Canadian entities were notified on the day of the action.
The RCMP is Canada's national representative on Operation Endgame. CTV News reported the RCMP's warning to WordPress users the following day.
Security Affairs reported that Evil Corp was previously responsible for the Zeus and Dridex banking malware. Europol later widened its announcement to cover the Amadey and StealC malware networks hit in the same phase.
What we don't know yet
The RCMP did not say how many Canadian websites or computers were affected, and no arrests were announced in connection with SocGholish.
What to do
- WordPress site owners should change login credentials and turn on multi-factor authentication.
- Delete any unknown or unused WordPress accounts, which attackers often add for persistence.
- Keep WordPress core, themes and plugins updated.
- Remind staff that browsers update themselves; a web page prompting a "browser update" download is a red flag.
