Microsoft and Law Enforcement Target Amadey and StealC in Joint Takedown
Summary
Microsoft and law enforcement used a court-authorized operation to target more than 200 command-and-control servers shared by Amadey and StealC. Microsoft said the tools were linked to over 140,000 infected computers in one week.
Key points
- Microsoft and law enforcement partners conducted a joint, court-authorized takedown targeting the Amadey botnet and StealC infostealer.
- Microsoft said the operation targeted more than 200 command-and-control servers used by the two tools.
- Microsoft said Amadey and StealC share infrastructure and are often used together; Amadey can deliver StealC and other malware.
- Microsoft linked the tools to more than 140,000 infected computers worldwide during the first week of May.
- Microsoft said insights from Copilot helped its legal team treat the two malware families as part of a single criminal conspiracy.
- StealC is described as a malware-as-a-service infostealer that collects data from browsers, cryptocurrency wallets, messaging apps, email clients, and gaming platforms.
Article Details
- Event Type
- Court-authorized joint takedown targeting the shared command-and-control infrastructure of the Amadey botnet and StealC infostealer.
- Impact
- Microsoft and law enforcement disrupted more than 200 command-and-control servers. Microsoft said Amadey and StealC were linked to more than 140,000 infected computers worldwide in the first week of May; the article does not specify the year. The malware families were often used together, and Microsoft said Copilot helped its legal team treat them as part of a single criminal conspiracy.
People
Malware
AmadeyMicrosoft and law enforcement coordinated a court-authorized takedown that targeted Amadey and StealC at the same time, disrupting the shared infrastructure used by both criminal tools.StealCMicrosoft and law enforcement coordinated a court-authorized takedown that targeted Amadey and StealC at the same time, disrupting the shared infrastructure used by both criminal tools.
Vendors
BitsightMicrosoft had been tracking Amadey with ESET, BitSight, Lumen and Mitsui Bussan Secure Directions.ESETMicrosoft had been tracking Amadey with ESET, BitSight, Lumen and Mitsui Bussan Secure Directions.IBM X-ForceMeanwhile, Europol had been investigating StealC alongside law enforcement partners including Germany’s Federal Criminal Police Office and the Dutch and Danish National Police as well as IBM X-Force and Proofpoint.Lumen TechnologiesMicrosoft had been tracking Amadey with ESET, BitSight, Lumen and Mitsui Bussan Secure Directions.MicrosoftMicrosoft and law enforcement coordinated a court-authorized takedown that targeted Amadey and StealC at the same time, disrupting the shared infrastructure used by both criminal tools.Mitsui Bussan Secure DirectionsMicrosoft had been tracking Amadey with ESET, BitSight, Lumen and Mitsui Bussan Secure Directions.ProofpointMeanwhile, Europol had been investigating StealC alongside law enforcement partners including Germany’s Federal Criminal Police Office and the Dutch and Danish National Police as well as IBM X-Force and Proofpoint.
Products
Countries
GermanyMeanwhile, Europol had been investigating StealC alongside law enforcement partners including Germany’s Federal Criminal Police Office and the Dutch and Danish National Police as well as IBM X-Force and Proofpoint.RussiaIt’s typically used by Russia-linked groups.UkraineAmadey dates back to 2018, and is also commonly employed by Russian groups, including in attacks on Ukraine.