ASD Says It Cut Off an Amadey Controller Serving 180,000 Computers
Summary
Australia’s ASD says it accessed an Amadey operator’s backend and disconnected its controller from 180,000 infected computers worldwide. The article also describes a separate ASD operation to destroy stolen data before its sale.
Key points
- ASD says its operators accessed an Amadey criminal operation’s backend and disconnected its controller from 180,000 infected computers worldwide, including some in Australia.
- Amadey can install other malware, steal credentials, and provide remote access; reported infection routes include fake software updates, cracked installers, and other malware loaders.
- ESET identified 53 separate Amadey botnets that did not share infrastructure.
- The disruption does not undo earlier theft: credentials may be used months later, and a stolen session cookie can allow an attacker to bypass MFA, according to cited analysis.
- In a separate case, ASD says it destroyed a 5-terabyte dataset offered for sale. The agency estimated the files included 4.8 million stolen from Australians and hundreds of thousands from victims elsewhere.
- Operation Endgame targeted servers associated with Amadey, StealC, and SocGholish in June; Europol’s announcement did not list Australia among participants in that action week or mention ASD.
Article Details
- Event Type
- Australian Signals Directorate (ASD) cyber operation disrupting an Amadey malware controller
- Impact
- ASD says it accessed the criminal operation's backend and disconnected its controller from 180,000 infected computers worldwide, including some in Australia, cutting off the operator's access to those computers. The article notes this does not reverse any earlier data theft. Separately, ASD said it destroyed stolen business data before it could be sold; the files included an estimated 4.8 million taken from Australians and hundreds of thousands from victims in other countries.
People
Malware
AmadeyA criminal using the Amadey malware can no longer access or steal data from 180,000 infected computers around the world, including some in Australia, the Australian Signals Directorate (ASD) says. The agency's operatorsSocGholishBetween June 15 and 19, the operation targeted servers associated with Amadey, StealC, and the SocGholish malware.StealC(C2) server and carry out its orders. Amadey's main job is to install more malware, such as the StealC infostealer. It can also steal credentials and give the buyer remote access to the machine.