ASD disconnects an Amadey controller from 180,000 devices
Australia’s Signals Directorate (ASD) gained access to the backend of a criminal Amadey malware operation and disconnected its controller from 180,000 infected computers worldwide. The action prevented the operator from continuing to access those devices or steal data from them, including from affected systems in Australia.
Tauri Gregory, ASD’s acting deputy director-general of intelligence, told ABC News that the operational next step was to disconnect the Amadey controller from all of its victims. ASD is Australia’s foreign signals intelligence and cyber security agency; its offensive cyber operations require explicit approval from the Australian government and can disrupt overseas cybercriminal infrastructure.
How the Amadey operation worked
Amadey has been sold to criminals as a service since 2018, ESET reported. Buyers operate separate control panels on their own servers, creating distinct botnets rather than a single shared platform. In ESET’s tracking, 53 Amadey botnets used infrastructure that was not shared between them.
Once a computer is infected, Amadey checks in with the buyer’s command-and-control server and follows its instructions. Its principal role is to install additional malware, including the StealC infostealer. It can also steal credentials and provide the buyer with remote access to the compromised machine.
Fake software updates, cracked software installers and other malware loaders were among the most common methods used to deliver Amadey. The separation between buyer-run infrastructures explains why disrupting one controller can protect the devices tied to that operation without eliminating the wider malware ecosystem.
Disruption does not erase stolen data
Disconnecting a command-and-control server stops further communication between that controller and its infected devices, but it does not recover information already taken. Microsoft has noted that credentials collected by infostealers can remain unused for months before attackers attempt to exploit them.
Stolen session cookies are a further concern because they can enable an attacker to bypass multi-factor authentication. A disruption operation can therefore limit an attacker’s future access while leaving organisations with the task of identifying compromised accounts, ending active sessions and replacing exposed credentials.
Related enforcement activity and a separate ASD case
Amadey infrastructure was also targeted in June during Operation Endgame, an international law-enforcement effort involving private partners. Between June 15 and 19, the operation acted against servers associated with Amadey, StealC and SocGholish. Australia is one of nine countries whose law-enforcement and judicial authorities run Operation Endgame together, Europol said, although Australia was not listed among participants in the June action week and the announcement did not name ASD.
ASD also described a separate case in which it received a tip that 5 terabytes of stolen business data were being offered for sale. The affected business was unaware of the breach. ASD broke into the criminal environment and destroyed the data, including an estimated 4.8 million files stolen from Australians and hundreds of thousands from victims in other countries.
For businesses, the practical implication is that infrastructure disruption is valuable but is not a substitute for incident response: suspected infostealer exposure requires prompt device remediation, credential changes and session invalidation to address data that may already be in criminal hands.