Microsoft and Partners Disrupt Shared Amadey and StealC Infrastructure
Summary
Microsoft, Europol, law enforcement and security firms targeted hundreds of servers and domains in an Operation Endgame action against infrastructure shared by Amadey and StealC. Europol reported seized credentials, secured computers and flagged crypto assets.
Key points
- The Operation Endgame action targeted hundreds of domains and servers linked to the Amadey loader and StealC infostealer.
- AI-powered analysis found the malware families shared command-and-control infrastructure, helping partners coordinate the takedown.
- Europol said more than 25 million unique stolen credentials from over 385,000 systems were seized, and 18,000 compromised computers were identified and secured.
- Europol reported that crypto assets valued at more than $47 million were identified and flagged to restrict their use.
- Researchers found a vulnerability in StealC’s command-and-control panel that allowed a web shell to be uploaded; it was exploited to collect data for the operation.
- The article says there is evidence a StealC affiliate also used the panel flaw to steal data from other affiliates.
Article Details
- Event Type
- Joint law-enforcement and cybersecurity industry takedown targeting infrastructure shared by the Amadey and StealC malware families as part of Operation Endgame.
- Impact
- Hundreds of domains and servers were targeted for takedown. More than 25 million stolen credentials from over 385,000 systems were seized, 18,000 compromised computers were identified and secured, and crypto assets valued at more than $47 million were identified and flagged to restrict their use.
Malware
AmadeyMicrosoft, law enforcement, and several cybersecurity companies have collaborated to take down infrastructure shared by two widely used malware families: Amadey and StealC.StealCMicrosoft, law enforcement, and several cybersecurity companies have collaborated to take down infrastructure shared by two widely used malware families: Amadey and StealC.
Vendors
BitsightMicrosoft, Europol, ESET, Bitsight, IBM X-Force, Proofpoint, and Japan’s Mitsui Bussan Secure Directions (MBSD) have published blog posts describing the action taken against Amadey and StealC.ESETMicrosoft, Europol, ESET, Bitsight, IBM X-Force, Proofpoint, and Japan’s Mitsui Bussan Secure Directions (MBSD) have published blog posts describing the action taken against Amadey and StealC.IBM X-ForceMicrosoft, Europol, ESET, Bitsight, IBM X-Force, Proofpoint, and Japan’s Mitsui Bussan Secure Directions (MBSD) have published blog posts describing the action taken against Amadey and StealC.MicrosoftMicrosoft, law enforcement, and several cybersecurity companies have collaborated to take down infrastructure shared by two widely used malware families: Amadey and StealC.Mitsui Bussan Secure DirectionsMicrosoft, Europol, ESET, Bitsight, IBM X-Force, Proofpoint, and Japan’s Mitsui Bussan Secure Directions (MBSD) have published blog posts describing the action taken against Amadey and StealC.ProofpointMicrosoft, Europol, ESET, Bitsight, IBM X-Force, Proofpoint, and Japan’s Mitsui Bussan Secure Directions (MBSD) have published blog posts describing the action taken against Amadey and StealC.