SocGholish turns ordinary legitimate websites into ransomware entry points by showing visitors a convincing "your browser needs an update" prompt. This guide profiles SocGholish, also tracked as FakeUpdates, and its operator Mustard Tempest (TA569) for defenders: how compromised sites filter and lure visitors, what the JavaScript payload does on a Windows host, how access is handed to ransomware groups, the June 2026 Operation Endgame action against it, and the detections and simple hardening steps that stop the chain. It is for SOC analysts, endpoint engineers and website owners, because SocGholish has two kinds of victim: the people who download the fake update and the organisations whose sites serve it. The Drive-by Downloads Guide covers the general technique; this page is about the SocGholish family.
Key takeaways
- An initial access business, not a single crew. MITRE ATT&CK describes SocGholish (S1124) as a JavaScript loader used since at least 2017, operated by Mustard Tempest (G1020), an initial access broker whose access has been sold to groups including Indrik Spider (Evil Corp).
- The lure lives on sites you trust. Proofpoint describes injected JavaScript on compromised legitimate websites, with filtering so that only eligible Windows visitors arriving from an external referrer see the fake update.
- The payload is a script, so the fix can be simple. Red Canary reports both ZIP-wrapped and, since late 2022, direct JavaScript delivery, and recommends making Windows open .js files in Notepad rather than executing them.
- Domain-joined hosts are the prize. Proofpoint reports ransomware such as WastedLocker, Hive and LockBit on domain-joined victims, while domain trust discovery (T1482) is the early warning that an operator is sizing the network.
- Law enforcement has started to act directly against it. Operation Endgame reported in June 2026 that 326 servers and 142 domains were actioned against SocGholish, Amadey and StealC, and 14,971 infected websites were remediated.
Who they are (names and aliases)
| Name or entity | Type | What the sources say |
|---|---|---|
| SocGholish, FakeUpdates | Malware family (ATT&CK S1124) | JavaScript-based loader used since at least 2017, mainly through drive-by downloads posing as software updates (ATT&CK). Red Canary dates it to at least April 2018. |
| Mustard Tempest (DEV-0206, TA569, GOLD PRELUDE, UNC1543) | Initial access broker (G1020) | Has operated the SocGholish distribution network since at least 2017 and partnered with Indrik Spider to provide access for LockBit, WastedLocker and remote access tools (ATT&CK). |
| Indrik Spider (Evil Corp, Manatee Tempest, DEV-0243, UNC2165) | Russia-based cybercriminal group (G0119) | Active since at least 2014, began with Dridex and moved to ransomware (ATT&CK). Operation Endgame and Red Canary both link SocGholish to Evil Corp. |
Proofpoint notes ransomware activity after SocGholish overlaps with Evil Corp, Gold Drake and UNC2165, but does not equate TA569 with those actors. Keep the distinction: the broker and the ransomware buyer are different businesses. See the Evil Corp Threat Actor Profile Guide.
Targeting and motivation
SocGholish is financially motivated and opportunistic. It reaches whoever visits an infected site, then filters. ATT&CK notes use against multiple sectors globally.
- Website victims: Proofpoint tracked over 1,000 active implants on compromised sites in 2022. Operation Endgame describes the lures as served from compromised websites, often WordPress sites, and remediated 14,971 of them in 2026.
- Visitor victims: traffic often arrives through marketing emails, aggregators and search feeds that link unknowingly to infected pages (Proofpoint).
- Selection: Proofpoint describes eligibility checks such as a Windows host, an external referral and cookie checks; visiting the URL directly does not trigger the script, which frustrates analysts and sandboxes.
- Monetisation: domain-joined hosts are sold or handed to ransomware operators; non-domain machines more often receive a remote access trojan (Proofpoint). Red Canary saw a second-stage payload in roughly one in four incidents, most often MintsLoader leading to AsyncRAT or StealC.
- Prevalence: SocGholish ranked eighth overall in Red Canary's Threat Detection Report, affecting 2.3 percent of its customers.
Tactics and techniques (MITRE ATT&CK)
ATT&CK v20 maps 19 techniques to SocGholish, a small set because the loader's job is to profile and hand off.
| Stage | ATT&CK techniques | What defenders see |
|---|---|---|
| Initial access | T1189 Drive-by Compromise, T1566.002 Spearphishing Link, T1204.001 Malicious Link | A browser download of a file named like an update, from a legitimate-looking domain, shortly after visiting an unrelated site. |
| Masquerading and packaging | T1036.005 Match Legitimate Resource Name or Location, T1027.013 Encrypted/Encoded File, T1027.015 Compression | ZIP archives or .js files with browser update names; Red Canary notes homoglyph characters in file names. |
| Execution | T1059.007 JavaScript, T1047 Windows Management Instrumentation | wscript.exe launched with a .js file from the Downloads folder, followed by WMI queries. |
| Discovery | T1082 System Information Discovery, T1033 System Owner/User Discovery, T1016 System Network Configuration Discovery, T1482 Domain Trust Discovery, T1518 Software Discovery, T1057 Process Discovery, T1614 System Location Discovery | Host, user and domain profiling, often in memory, with results sent out. |
| Collection and exfiltration | T1074.001 Local Data Staging, T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol | Profile data staged locally and sent to attacker infrastructure. |
| Command and control | T1102 Web Service, T1105 Ingress Tool Transfer | Second-stage downloads from web services or attacker domains. |
How they abuse identities and credentials
- Website administrator accounts: the infection starts with compromised site credentials. Operation Endgame told WordPress owners to change login credentials, enable multi-factor authentication, delete unknown accounts and keep sites updated, and reported 1.4 million websites with leaked credentials in its June 2026 action.
- Stolen user credentials: the Endgame action recovered 27 million stolen credentials across SocGholish, Amadey and StealC, and used Have I Been Pwned for victim notification. Follow-on stealers take browser passwords and sessions. See the Infostealer Threat Guide.
- Domain context: the user's domain identity is what makes the access valuable. Domain trust discovery from a user's workstation is unusual and worth an alert.
- Response implication: treat the user's credentials and active sessions as exposed, and check for new remote access tools that would let a buyer return without the loader.
Notable incidents
| Date | Event | Source and key facts |
|---|---|---|
| 2017 to 2018 | First activity | ATT&CK: in use since at least 2017; Red Canary: active since at least April 2018. |
| November 2022 | Proofpoint analysis of TA569 | Over 1,000 active implants; eligibility filtering; ransomware such as WastedLocker, Hive and LockBit on domain-joined victims. |
| Late 2022 onward | Direct JavaScript delivery | Red Canary: direct .js delivery alongside ZIP; in 2025 about two thirds of detected infections used direct JavaScript. |
| 2025 | Ransomware precursor activity | Red Canary saw a Python backdoor with reconnaissance overlapping reports that link SocGholish to RansomHub affiliates. |
| 18 June 2026 | Operation Endgame action week | Dutch NHCTU, RCMP, FBI and BKA, supported by Europol and Eurojust: 106 servers and domains taken down, 14,971 websites remediated. |
| 24 June 2026 | Wider Endgame disruption | 326 servers and 142 domains actioned against SocGholish, Amadey and StealC; over 41 million euros in crypto assets flagged; 27 million credentials recovered. |
Takedown figures come from the operation's own announcements and describe one action period. Expect successors and re-emergence; see the Cybercrime Law Enforcement Takedowns Guide.
Detection and defence
Behaviour-level detection ideas
- Browser to script host: Red Canary recommends alerting on wscript.exe launched by a browser that then makes external network connections. Extend this to wscript or cscript running a .js file from Downloads or a ZIP temp folder.
- Trust discovery: Red Canary recommends alerting on nltest.exe with domain trust arguments, which can precede ransomware.
- Script telemetry: collect script load and AMSI telemetry through EDR, because much of the reconnaissance runs in memory.
- Proxy and DNS: downloads of .js or .zip files with update names from non-vendor domains; first-seen domains contacted by wscript.exe.
- Follow-on: scheduled tasks created by the user shortly after a script host ran, and new remote access tools.
Hardening options
| Control | Effect | Trade-off and decision |
|---|---|---|
| Change the default handler for .js (and similar script types) to Notepad by Group Policy (Red Canary) | Double-clicked scripts open as text instead of running | Very low cost; do this first everywhere. |
| Block wscript and cscript for standard users with application control | Stops the payload even if the handler is changed back | Check legacy logon scripts first; run in audit mode for two weeks. |
| Browser update policy: updates managed centrally, users told no website ever asks them to update their browser | Removes the lure's credibility | Needs a clear message; Endgame advises getting updates only through system settings or app stores. |
| Web filtering of newly registered and uncategorised domains | Breaks some second-stage downloads | Some false positives; allow user-requested exceptions. |
| For website owners: MFA on CMS admin, remove unknown accounts, patch plug-ins, monitor file integrity | Stops your site becoming a distribution point | Applies to marketing sites that IT may not own; assign an owner. |
Framework mapping
| Defence | NIST SP 800-53 Rev. 5 | NIST CSF 2.0 |
|---|---|---|
| Script execution restrictions and default handler change | CM-7, CM-6 | PR.PS-05 |
| Malicious code protection and web filtering | SI-3, SC-7 | DE.CM-09 |
| Monitoring for discovery and C2 | SI-4 | DE.CM-01 |
| Awareness of fake update lures | AT-2 | PR.AT-01 |
Response steps
- Stop running wscript.exe instances and isolate the host (Red Canary remediation guidance).
- Remove malicious scheduled tasks for the affected user and delete payloads stored on disk or in the registry.
- Check for second-stage tools (loaders, RATs, stealers) and for domain discovery evidence; if discovery ran on a domain-joined host, escalate to a pre-ransomware incident.
- Reset the user's passwords and revoke sessions; review the site that served the lure and report it to its owner or hosting provider.
- Follow the Malware Outbreak Playbook for scoping and recovery.
Common mistakes
- Closing the alert as a false positive: Proofpoint warns defenders not to dismiss these alerts, because most infections stop at profiling and look harmless until a buyer arrives.
- Blocking the one site: the injected script moves across thousands of sites, so a domain block on the lure page alone protects little; block the script execution instead.
- Testing by visiting the URL: the eligibility filtering means a direct visit often shows a clean page, which leads analysts to conclude the site is safe.
- Ignoring the marketing site: organisation-owned WordPress sites managed by agencies are frequently outside patching and MFA programmes.
Metrics that show it is working
- Percentage of Windows endpoints where .js opens in a text editor by default.
- Number of wscript or cscript executions by standard users per week (target: near zero).
- Median time from a browser-to-script-host alert to isolation.
- Number of organisation-owned websites with MFA on every admin account and patched plug-ins.
Practitioner checklist
- Set the default program for .js, .jse, .vbs and .wsf to Notepad by Group Policy.
- Restrict Windows Script Host for standard users after an audit-mode trial.
- Alert on browsers spawning script hosts and on nltest domain trust queries from workstations.
- Collect script and AMSI telemetry in your EDR.
- Tell staff that real browser updates never come from a web page prompt.
- Audit every website your organisation owns for admin MFA, unknown accounts and outdated plug-ins.
- Treat a SocGholish hit on a domain-joined host as a pre-ransomware incident.
Standards and references
- MITRE ATT&CK: SocGholish (S1124)
- MITRE ATT&CK: Mustard Tempest (G1020)
- MITRE ATT&CK: Indrik Spider (G0119)
- Operation Endgame: News
- Proofpoint: SocGholish, a very real threat from a very fake update
- Red Canary: Threat Detection Report, SocGholish
- MITRE ATT&CK: Drive-by Compromise (T1189)
- NIST: SP 800-53 Rev. 5
Related NHI Mgmt Group resources: Drive-by Downloads Guide · Evil Corp Threat Actor Profile Guide · Initial Access Brokers Guide · ClickFix and Fake CAPTCHA Paste-and-Run Attacks Guide