The Australian Signals Directorate says it disconnected a criminal’s Amadey controller from 180,000 infected computers worldwide, including machines in Australia, preventing that operator from continuing to access or steal data from them.
According to The Hacker News, ASD operators gained access to the backend of the criminal’s operation before severing its connections to the infected machines. Tauri Gregory, ASD’s acting deputy director-general of intelligence, described the disconnection in an ABC News interview published on October 27. That is the interview’s publication date; the report does not establish when the operation occurred.
The intervention targeted one operator’s infrastructure within a wider malware ecosystem. The Hacker News, citing ESET’s analysis, reported that Amadey has been sold to criminals as a service since 2018, with each buyer running a separate control panel on its own servers. ESET identified 53 distinct Amadey botnets that did not share infrastructure.
Breaking the command chain
An Amadey infection gives its operator a way to issue commands to a compromised computer. The malware checks in with a command-and-control server and can install additional malicious software, steal credentials and provide remote access, according to The Hacker News.
Microsoft’s June 24 analysis describes Amadey as a malware-as-a-service loader used to deliver StealC and other payloads. StealC is a separate malware family that collects sensitive information, including browser credentials and cookies, and sends it to attacker-controlled infrastructure. Severing an Amadey controller’s connections interrupts that operator’s ability to direct the infected machines.
The disruption does not reverse earlier theft. Microsoft says stolen credentials can be used within 48–72 hours or remain dormant for months before an attacker uses them. Stolen session cookies can also allow attackers to bypass multifactor authentication. Those are documented risks of infostealer infections, rather than evidence that this particular operator carried out subsequent corporate intrusions.
Separate disruptions
Amadey infrastructure was also targeted in June through Operation Endgame. Europol’s announcement described coordinated action against Amadey, StealC and SocGholish. Australia is a member of the broader operation, but Europol did not list it among the countries participating in that action week or mention ASD. The announcement therefore does not establish a connection to the newly reported ASD intervention.
In another case described by The Hacker News, ASD said it received a tip that 5 terabytes of data stolen from a business were being offered for sale. The business had not known it was compromised. ASD said it accessed the criminal infrastructure and destroyed the data before a sale, including business documents, personal information and login credentials. The destroyed material included an estimated 4.8 million files stolen from Australians and hundreds of thousands from victims elsewhere.
