3 techniques observed across 1 entry — derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v19.1 · compare on the matrix · Navigator layer (JSON)
Initial Access TA0001
T1189Drive-by Compromise×1
Adversaries may gain access to a system through a user visiting a website over the normal course of browsing. Multiple ways of delivering exploit code to a browser exist (i.e., Drive-by Target), including:
T1059.007Command and Scripting Interpreter: JavaScript×1
Adversaries may abuse various implementations of JavaScript for execution. JavaScript (JS) is a platform-independent scripting language (compiled just-in-time at runtime) commonly associated with scripts in webpages, though JS can be executed in runtime environments outside the browser.
An adversary may rely upon a user opening a malicious file in order to gain execution. Users may be subjected to social engineering to get them to open a file that will lead to code execution. This user action will typically be observed as follow-on behavior from Spearphishing Attachment. Adversaries may use several types of files that require a user to execute them, including .doc, .pdf, .xls, .rtf, .scr, .exe, .lnk, .pif, .cpl, .reg, and .iso.
A coordinated law-enforcement action on 2026-06-18 — an expansion of the May 2024 Operation Endgame — dismantled infrastructure tied to TA569, the long-running operator of the SocGholish (FakeUpdates) initial-access framework (Politie, 2026-06-18; Help Net Security, 2026-06-18). The Dutch National High Tech Crime Unit led the operation with the RCMP, FBI, BKA and Europol; 106 command-and-control servers were taken down and the malicious JavaScript loader was removed from 14,971 compromised WordPress sites. SocGholish injects obfuscated JavaScript into legitimate WordPress sites (typically via stolen wp-admin credentials or vulnerable plugins), fingerprints visitors and renders a fake browser-update lure; accepting it drives a ZIP download of a .js/.lnk stage-1 that executes through wscript.exe or mshta.exe (T1189 Drive-by Compromise → T1059.007 JavaScript → T1204.002 User Execution), historically passing access to Evil Corp downstream affiliates (Proofpoint, 2026-06-18). This is the first Endgame phase to directly target the FakeUpdates component, an initial-access mechanism in continuous use since roughly 2017.