Authorities seize 106 servers, clean 15,000 WordPress sites

An international law enforcement operation has disrupted a major malware network, taking down more than 100 servers and cleaning nearly 15,000 infected websites used to spread malicious software. Authorities from the Netherlands, Canada, the United States, and Germany, with support from Europol and Eurojust, announced the coordinated action this week, dismantling key infrastructure of the SocGholish botnet.

The malware, also known as FakeUpdates, has been active since 2017. It operates by injecting malicious code into legitimate websites, primarily those using the WordPress content management system. Visitors to compromised sites, which included small businesses like restaurants and auto repair shops, were presented with fake browser or software update prompts. Downloading the fake update infected the user's computer, providing attackers with an initial foothold to deploy additional malicious tools, including ransomware and spyware.

The operation, conducted over a week, involved seizing 106 command-and-control servers and domains. Dutch police said they also removed malware and backdoors from 14,971 infected WordPress sites and notified the owners. The action is part of the...