Overview
- Investigators announced on Wednesday that they disabled the core infrastructure for SocGholish, StealC and Amadey so the malware can no longer deliver follow‑on attacks.
- The coordinated action rendered about 15,000 websites, more than 300 servers and over 140 domains unusable to the criminals who ran the schemes.
- Law enforcement seized roughly 27 million login credentials tied to more than 385,000 victims and will provide public platforms for people to check whether their data are included.
- Authorities traced about $47 million in cryptocurrency suspected to be criminal proceeds and said criminal probes are ongoing in Germany and other partner countries.
- The takedown was carried out under Operation Endgame with help from Europol, Eurojust and Microsoft, and it aims to slow the supply chain that fuels ransomware while prompting victims to reset credentials and monitor accounts.