RCMP Collaborates With International Partners to Disrupt SocGholish Malware Operation

The Royal Canadian Mounted Police (RCMP) has partnered with authorities in the Netherlands, the United States, and Germany to dismantle a cybercriminal operation linked to the Russian group Evil Corp, according to a joint statement released on June 19, 2026. The action, part of an initiative called Operation Endgame, targeted the SocGholish malware, which exploited thousands of WordPress sites to gain unauthorized access to systems and data.

What is SocGholish Malware?

SocGholish malware, attributed to the Russian cybercriminal group Evil Corp, was designed to trick users into downloading malicious files disguised as legitimate software updates. Investigators revealed that the malware compromised thousands of WordPress sites, creating a network of infected systems to steal sensitive information. The Dutch National Police described the malware as a “persistent threat” due to its ability to evade detection and maintain long-term access to targeted networks.

How Did the Operation Unfold?

The joint operation resulted in the takedown of 106 servers and domains worldwide, as reported by Dutch authorities. Over 15,000 websites were remediated, and infected WordPress sites were cleaned, according to the RCMP. The effort involved coordinated actions across multiple jurisdictions, highlighting the growing complexity of international cybercrime and the need for cross-border collaboration. A statement from the RCMP emphasized that the operation was “a significant blow to cybercriminal networks operating under the guise of legitimate software updates.”

What Steps Are Cybersecurity Experts Recommending?

Authorities urge WordPress site owners to take immediate steps to secure their platforms. Key recommendations include changing login credentials, enabling multi-factor authentication, and avoiding pop-ups or urgent update notices that appear in browsers. The Canadian Cyber Security Centre (CCSC) warned that “social engineering tactics like these are increasingly sophisticated, and users must remain vigilant to avoid falling victim to deceptive practices.”

Why Does This Matter for Global Cybersecurity?

The takedown of SocGholish malware underscores the evolving tactics of cybercriminal groups like Evil Corp, which have been linked to numerous high-profile attacks in recent years. In 2023, the U.S. Treasury sanctioned Evil Corp for its role in distributing the Dridex malware, which targeted financial institutions globally. The recent operation reflects a broader trend of international cooperation to counter state-sponsored and criminal cyber activities, as seen in the 2021 takedown of the Emotet botnet, another major malware network.

Experts note that while the operation disrupted a significant threat, the persistence of such malware highlights the need for continuous monitoring and updated security protocols. As one cybersecurity analyst noted, “This is a victory, but the battle against cybercrime is ongoing. Organizations must prioritize proactive measures to stay ahead of emerging threats.”