Australian Spies Cut Off Amadey Malware Operator From 180,000 Infected Computers
The takedown stops further control of the machines but cannot reverse credentials already stolen and held for later use.
Australia's Signals Directorate says it gained access to the backend of a criminal's Amadey malware operation and used that access to cut the attacker off from roughly 180,000 infected computers worldwide, including some in Australia. Amadey, sold as a service since 2018, lets each buyer run a control panel that directs infected machines to install further malware such as the StealC infostealer, harvest credentials and grant remote access. The takedown does not reverse earlier thefts, since stolen credentials can be held for months before use and session cookies can get around multi-factor authentication. Amadey infrastructure had already been hit in June by Operation Endgame, and ESET has identified 53 separate Amadey botnets that do not share infrastructure. ASD also separately reported destroying 5 terabytes of stolen data that was up for sale, including about 4.8 million records tied to Australians.
Why it matters
For people whose computers were infected, the immediate change is that the criminal can no longer direct those machines to install more malware or steal data from them. Stolen credentials and session cookies already taken remain a risk, because they can be used months later and can get around multi-factor authentication, so accounts may still need to be secured. The operation also shows that a malware service sold to many buyers can be disrupted at the level of its shared backend, even as other Amadey botnets that do not share infrastructure remain.
Matters or hype?
Does this story matter, or is it hype? Vote before you see what everyone else said.