# Operation Endgame: Global Law Enforcement Takedown Disrupts SocGholish, Amadey, and StealC Malware-as-a-Service Networks

> A coordinated international operation under the Operation Endgame banner, announced by Europol and the Microsoft Digital Crimes Unit on 24 June 2026, disrupted the distribution and command-and-control infrastructure of three prolific commodity malware families: the SocGholish (js.fakeupdates) JavaScript loader, the Amadey (win.amadey) loader/botnet, and the StealC (win.stealc) information stealer. Enforcement actions between 15-19 June 2026 dismantled 326 servers and 142 domains, recovered roughly 27 million stolen credentials, and identified/restricted more than EUR 41 million (USD 47 million+) in criminal crypto assets.

- **Published:** 2026-06-24T00:00:00Z
- **Last reviewed:** 2026-06-24T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0937
- **ID:** TL-2026-0937
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** InCrease
- **Detections:** 9 · **IOCs:** 31 (full data via the Threadlinqs MCP server — Purple tier)

## Description

On 24 June 2026, Europol — working with Eurojust, the Microsoft Digital Crimes Unit (DCU), and private-sector partners Bitdefender, Bitsight, and ESET — announced a landmark disruption of the criminal infrastructure behind three of the most widely used Windows commodity malware families as the latest chapter of Operation Endgame. Law-enforcement and judicial authorities from Belgium, Canada, Denmark, France, Germany, the Netherlands, the United Kingdom, and the United States participated. The actions, carried out between 15 and 19 June 2026, targeted the cybercriminal 'assembly lines' — the loaders, stealers, and distribution networks that feed downstream ransomware, financial fraud, and attacks on critical infrastructure — rather than individual infections.

The SocGholish (also tracked as FakeUpdates) network was disrupted first, in actions led by the Netherlands, Canada, the United States, and Germany with Europol and Eurojust support, with public reporting placing the SocGholish action on or around 18 June 2026. SocGholish is a JavaScript-based loader in use since at least 2017, operated by the actor cluster Mustard Tempest (MITRE G1020) and historically used to broker access sold to groups such as Indrik Spider for follow-on RAT and ransomware delivery. It spreads through drive-by 'fake update' lures injected into compromised, legitimate websites — nearly 15,000 compromised WordPress sites were identified and remediated as part of the operation — frequently fronted by traffic-distribution systems such as Parrot TDS and Keitaro TDS and abusing domain shadowing.

The Amadey and StealC disruption was executed jointly with the Microsoft DCU, which severed criminal control of roughly 18,000 victim computers and disabled approximately 200 C2 domains/IPs. Amadey is a modular loader/botnet active since October 2018 (latest tracked version 5.87), sold by a threat actor using the moniker 'InCrease' for roughly USD 600 per license plus USD 50 per rebuild. Amadey performs host fingerprinting, downloads and executes secondary payloads (DLL, MSI, PowerShell), runs commands via cmd.exe, captures screenshots, spawns SOCKS proxies and VNC/reverse-proxy sessions, harvests credentials and clipboard data, and can enable RDP. It is distributed via compromised WordPress sites, phishing, and upstream loaders such as Emmenhtal and SmokeLoader, and across roughly 53 affiliate clusters has delivered Lumma Stealer, Vidar, StealC, RedLine, Rhadamanthys, Agent Tesla, PureCrypter, Rugmi, SmokeLoader, XWorm, and AsyncRAT. Amadey reuses its CreateMutexA mutex name as the RC4 key for encrypting C2 traffic and includes CIS locale checks that disable theft on Russian, Ukrainian, and Belarusian systems.

StealC is a C++ information stealer first observed in January 2023, operated by an actor using the handle 'plymouth'; the StealC v2 line (latest tracked 2.2.1, sold at roughly USD 300/month or USD 1,000 for six months) was rebuilt in early 2025 with server-side decryption, expanded browser/wallet coverage, and PowerShell/MSI loader functionality. It extracts credentials, session cookies, autofill and credit-card data, browsing history, and application data from Chromium browsers and desktop apps (Discord, FileZilla, Foxmail, Outlook, Steam, Telegram), and is delivered via loaders (including Amadey) and ClickFix social-engineering lures. StealC samples are frequently protected with the Themida packer and apply CIS geo-blocking (Russia, Ukraine, Belarus, Kazakhstan, Uzbekistan). In early 2026 the StealC ecosystem itself drew scrutiny: CyberArk disclosed a stored XSS in the StealC web panel (Jan 2026), and a directory-traversal flaw allowing web-shell upload to StealC C2 servers was patched in Feb 2026 after exploitation. Microsoft reported 140,000+ devices infected by the combined operations in the first two weeks of May 2026.

This record documents a defensive intelligence picture of the takedown for SOC hunting and detection validation. Although the criminal infrastructure was disrupted, the malware families, builders, and affiliate tradecraft remain in circulation, so detection and hunting for the associated TTPs and residual IOCs remain warranted.

## MITRE ATT&CK

- T1189 Drive-by Compromise
- T1566.002 Spearphishing Link
- T1204.001 Malicious Link
- T1204.002 Malicious File
- T1059.007 JavaScript
- T1059.001 PowerShell
- T1059.003 Windows Command Shell
- T1047 Windows Management Instrumentation
- T1106 Native API
- T1547.001 Registry Run Keys / Startup Folder
- T1053.005 Scheduled Task
- T1548.002 Bypass User Account Control
- T1055 Process Injection
- T1027.013 Encrypted/Encoded File
- T1027.015 Compression
- T1036.005 Match Legitimate Resource Name or Location
- T1140 Deobfuscate/Decode Files or Information
- T1497.001 System Checks
- T1218.007 Msiexec
- T1555.003 Credentials from Web Browsers
- T1539 Steal Web Session Cookie
- T1056 Input Capture
- T1082 System Information Discovery
- T1614 System Location Discovery
- T1518 Software Discovery
- T1057 Process Discovery
- T1016 System Network Configuration Discovery
- T1033 System Owner/User Discovery
- T1482 Domain Trust Discovery
- T1021.001 Remote Desktop Protocol
- T1074.001 Local Data Staging
- T1113 Screen Capture
- T1115 Clipboard Data
- T1005 Data from Local System
- T1071.001 Web Protocols
- T1105 Ingress Tool Transfer
- T1102 Web Service
- T1090 Proxy
- T1573.001 Symmetric Cryptography
- T1219 Remote Access Tools

## Sources

- [Global cyber strike disrupts SocGholish, Amadey, and StealC malware networks](https://www.europol.europa.eu/media-press/newsroom/news/global-cyber-strike-disrupts-socgholish-amadey-and-stealc-malware-networks)
- [Malpedia Library: Global cyber strike disrupts SocGholish, Amadey, and StealC malware networks](https://malpedia.caad.fkie.fraunhofer.de/library/7da7c8bf-acc9-4460-987b-0223e8b4f2f8/)
- [Amadey and StealC Malware Network Disrupted, 27M Stolen Credentials Recovered](https://thehackernews.com/2026/06/amadey-and-stealc-malware-network.html)
- [Operation Endgame Disrupts StealC, Amadey and SocGholish Malware Networks](https://hackread.com/operation-endgame-stealc-amadey-socgholish-malware/)
- [Europol-Led Operation Endgame Takes Down StealC and Amadey Infostealers](https://www.infosecurity-magazine.com/news/operation-endgame-stealc-amadey/)
- [Three 'cybercrime as a service' operations undercut by Microsoft, law enforcement](https://therecord.media/stealc-amadey-socgholish-malware-takedown-europol-microsoft)
- [Microsoft and Allies Smash Shared Infrastructure of Amadey and StealC Malware](https://www.securityweek.com/microsoft-and-allies-smash-shared-infrastructure-of-amadey-and-stealc-malware/)
- [SocGholish, Software S1124 | MITRE ATT&CK](https://attack.mitre.org/software/S1124/)
- [StealC v2 Malware Enhances Stealth and Expands Data Theft Features](https://www.picussecurity.com/resource/blog/stealc-v2-malware-enhances-stealth-and-expands-data-theft-features)
- [Amadey Threat Analysis and Detections](https://www.splunk.com/en_us/blog/security/amadey-threat-analysis-and-detections.html)
- [Amadey Exploiting Self-Hosted GitLab to Distribute StealC](https://www.trellix.com/blogs/research/amadey-exploiting-self-hosted-gitlab-to-distribute-stealc/)
- [Bitsight Aids Disruption Efforts on Amadey & StealC Malware](https://www.bitsight.com/blog/bitsight-aids-disruption-efforts-on-amadey-malware-and-stealc-malware)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0937