Executive Summary
In June 2026, Europol, in collaboration with international law enforcement agencies and private sector partners, executed Operation Endgame, a coordinated effort targeting the infrastructure supporting the SocGholish, Amadey, and StealC malware networks. This operation led to the dismantling of 326 servers and 142 domains, the recovery of 27 million stolen login credentials, and the seizure of over €41 million in cryptocurrency assets. The SocGholish malware, linked to the Russian cybercriminal group Evil Corp, had compromised nearly 15,000 legitimate websites to distribute malicious software. Amadey and StealC were utilized to gain initial access to systems and exfiltrate sensitive data, respectively. (europol.europa.eu)
This operation signifies a strategic shift in combating cybercrime by disrupting entire malware ecosystems rather than focusing on individual threats. The success of Operation Endgame underscores the effectiveness of international cooperation and public-private partnerships in addressing large-scale cyber threats. (europol.europa.eu)
Why This Matters Now
The dismantling of these malware networks highlights the evolving tactics of cybercriminals and the necessity for continuous vigilance and collaboration among global cybersecurity entities to prevent the resurgence of such threats.
Attack Path Analysis
Attackers exploited vulnerabilities in Cisco Unified Communications Manager (CVE-2026-20230) and Cisco Catalyst SD-WAN Manager (CVE-2026-20245) to gain initial access. They escalated privileges to root by exploiting these vulnerabilities. Lateral movement was achieved by leveraging compromised systems to access additional network resources. Command and control were established through persistent access to the compromised infrastructure. Exfiltration involved extracting sensitive data from the network. The impact included operational disruption and potential data breaches.
Kill Chain Progression
Initial Compromise
Description
Attackers exploited CVE-2026-20230 in Cisco Unified Communications Manager and CVE-2026-20245 in Cisco Catalyst SD-WAN Manager to gain unauthorized access.
Related CVEs
CVE-2026-20230
CVSS 8.6A server-side request forgery (SSRF) vulnerability in Cisco Unified Communications Manager allows unauthenticated remote attackers to write files to the operating system, potentially leading to root privilege escalation.
Affected Products:
Cisco Unified Communications Manager – N/A
Exploit Status:
exploited in the wildCVE-2026-20245
CVSS 7.8A privilege escalation vulnerability in Cisco Catalyst SD-WAN Controller, Manager, and Validator allows authenticated local attackers to execute arbitrary commands as root by supplying a crafted file.
Affected Products:
Cisco Catalyst SD-WAN Controller – N/A
Cisco Catalyst SD-WAN Manager – N/A
Cisco Catalyst SD-WAN Validator – N/A
Exploit Status:
exploited in the wild
MITRE ATT&CK® Techniques
Application Layer Protocol: Web Protocols
Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
Data from Local System
Ingress Tool Transfer
Modify Registry
System Information Discovery
System Owner/User Discovery
Dynamic Resolution: Fast Flux DNS
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
PCI DSS 4.0 – Ensure that security policies and operational procedures for detecting and responding to failures of critical security control systems are documented, in use, and known to all affected parties.
Control ID: 6.4.3
NYDFS 23 NYCRR 500 – Cybersecurity Policy
Control ID: 500.03
DORA – ICT Risk Management Framework
Control ID: Article 5
CISA ZTMM 2.0 – Identity and Access Management
Control ID: 3.1
NIS2 Directive – Cybersecurity Risk Management Measures
Control ID: Article 21
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Telecommunications
Critical exposure through Cisco SD-WAN and communications infrastructure targeting, with multi-vector campaigns exploiting network equipment for persistent root access and configuration theft.
Transportation
Direct impact demonstrated by Transport for London breach causing £29 million damage, disrupting operations and forcing mass password resets across transportation networks.
Computer Software/Engineering
macOS.Gaslight specifically targets AI triage systems and LLM-assisted analysis tools, undermining software development security processes and automated threat detection capabilities.
Financial Services
HuiOne Group infrastructure seizure reveals billions in illicit transactions, while credential theft and ransomware deployment directly threaten banking operations and compliance.
Sources
- The Good, the Bad and the Ugly in Cybersecurity – Week 26https://www.sentinelone.com/blog/the-good-the-bad-and-the-ugly-in-cybersecurity-week-26-7/Verified
- Cisco Unified Communications Manager Server-Side Request Forgery Vulnerabilityhttps://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cucm-ssrf-cXPnHcWVerified
- Cisco Catalyst SD-WAN Controller, Catalyst SD-WAN Manager, and Catalyst SD-WAN Validator Authenticated Privilege Escalation Vulnerabilityhttps://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-privesc-4uxFrdzxVerified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Aviatrix Zero Trust CNSF is pertinent to this incident as it would likely limit the attacker's ability to move laterally and exfiltrate data by enforcing strict segmentation and identity-based access controls.
Control: Cloud Native Security Fabric (CNSF)
Mitigation: While initial exploitation may still occur, CNSF would likely limit the attacker's ability to leverage compromised systems to access additional network resources.
Control: Zero Trust Segmentation
Mitigation: Zero Trust Segmentation would likely limit the attacker's ability to escalate privileges by enforcing strict access controls and minimizing trust relationships between systems.
Control: East-West Traffic Security
Mitigation: East-West Traffic Security would likely constrain lateral movement by monitoring and controlling internal traffic flows, thereby limiting unauthorized access to other systems.
Control: Multicloud Visibility & Control
Mitigation: Multicloud Visibility & Control would likely detect and limit unauthorized command and control communications by providing comprehensive monitoring across cloud environments.
Control: Egress Security & Policy Enforcement
Mitigation: Egress Security & Policy Enforcement would likely restrict data exfiltration by controlling and monitoring outbound traffic, thereby reducing the risk of unauthorized data transfers.
The implementation of CNSF controls would likely reduce the overall impact by limiting the attacker's ability to disrupt operations and exfiltrate data, thereby minimizing potential data breaches.
Impact at a Glance
Affected Business Functions
- Unified Communications
- Network Management
Estimated downtime: 7 days
Estimated loss: $47,000,000
Approximately 27 million stolen credentials and over $47 million in cryptocurrency tied to illicit activities.
Recommended Actions
Key Takeaways & Next Steps
- • Implement Zero Trust Segmentation to limit lateral movement within the network.
- • Deploy Inline IPS (Suricata) to detect and prevent exploitation of known vulnerabilities.
- • Utilize Cloud Firewall (ACF) to enforce egress security and prevent unauthorized data exfiltration.
- • Enhance Threat Detection & Anomaly Response capabilities to identify and respond to suspicious activities promptly.
- • Regularly update and patch systems to mitigate known vulnerabilities and reduce the attack surface.
