- The Australian Signals Directorate (ASD) disrupted a major Amadey malware operation, severing the criminal’s access to 180,000 infected computers worldwide.
- ASD gained access to the operator’s backend and disconnected the command-and-control server from victims, preventing further data theft in Australia and globally.
- The Amadey malware is primarily used as a loader to install infostealers like StealC, though stolen data may still be exploited months after initial theft.
The Australian Signals Directorate (ASD) has disrupted a major cybercriminal operation, severing a criminal’s access to 180,000 computers infected with the Amadey malware, including systems in Australia. The agency’s operators gained access to the criminal’s backend and cut off the command-and-control server from all victim machines, ASD’s acting deputy director-general of intelligence, Tauri Gregory, told ABC News on October 27.
“The next steps that we took were to disconnect that Amadey controller from all those victims,” Gregory said. ASD’s offensive cyber operations require explicit government approval to disrupt criminals overseas by disabling their infrastructure. Amadey, first sold as a service in 2018, allows each buyer to run a control panel on their own servers, according to ESET’s analysis.
Infected computers check in with the buyer’s C2 server to receive orders. Amadey’s primary function is to install additional malware, such as the StealC infostealer, and it can steal credentials or grant remote access to the machine.
However, disconnecting a controller does not undo previous theft. Microsoft’s analysis notes that stolen credentials can remain unused for months, and a stolen session cookie can bypass multi-factor authentication. In a separate case, ASD received a tip about 5 terabytes of stolen data for sale, destroyed it, and recovered an estimated 4.8 million records belonging to Australians.
✅ Follow BITNEWSBOT on Telegram, Facebook, LinkedIn, X.com, and Google News for instant updates.
