Australian Signals Directorate Cuts Criminal Off From 180,000 Computers Infected With Amadey Malware

The Australian Signals Directorate (ASD) says a criminal using the Amadey malware can no longer access or steal data from 180,000 infected computers around the world, including some in Australia. ASD's acting deputy director-general of intelligence, Tauri Gregory, told ABC News that operators gained access to the criminal's backend and disconnected the controller from all of those victims. ASD's offensive cyber operations need explicit government approval.

Amadey was sold to criminals as a service from 2018, according to ESET, and each buyer runs its own control panel on its own servers. Infected computers check in with that server and follow its orders. Its main job is to install more malware, such as the StealC infostealer, but it can also steal credentials and give the buyer remote access. It commonly spreads through fake software updates, cracked software installers and other malware loaders. ESET has identified 53 separate Amadey botnets that did not share infrastructure, so this operation was one of many.

Cutting off the controller does not undo earlier theft. Microsoft's analysis notes that credentials taken by infostealers can sit unused for months, and a stolen session cookie can let an attacker bypass multi-factor authentication. Amadey infrastructure was also disrupted in June by Operation Endgame, which targeted servers linked to Amadey, StealC and SocGholish.