Police raid malware network tied to Russia's Evil Corp hacker group

An international law-enforcement operation disrupted the SocGholish browser-based botnet on 19 Jun 2026. SocGholish has been used as a loader/redirector to deliver a range of malware and has been linked to the Russia-based cybercrime group Evil Corp; dismantling its infrastructure will reduce immediate distribution but affiliates and fallback domains/servers may persist. Organizations should monitor for SocGholish IOCs and domains, review email and web-proxy detections, apply browser and OS patches, and update endpoint protections to detect post-exploitation activity.