International law enforcement, coordinated through Europol and Eurojust, dismantled a major phase of Operation Endgame by cleaning SocGholish malware from 14,971 compromised WordPress sites and seizing 106 servers and domains tied to Evil Corp (INDRIK SPIDER). SocGholish has served as Evil Corp’s primary initial access mechanism for nearly a decade, delivering ransomware families including WastedLocker, Hades, and Phoenix CryptoLocker through convincing fake browser update prompts. The takedown disrupts Evil Corp’s infection pipeline but does not eliminate the threat: additional compromised WordPress sites outside the cleaned set likely remain active, and Evil Corp’s established pattern of rebranding ransomware families in response to OFAC sanctions signals continued operational resilience.