● Covered by 1 source · 1 reportMedium impact1 positive
Australian Signals Directorate Disconnects 180,000 Computers from Amadey Malware Backend
Key points
- ASD disconnected 180,000 computers from an Amadey malware backend.
- The operation prevents further data theft by this specific criminal.
- Amadey installs other malware like StealC and steals credentials.
- ASD's offensive cyber operations require government approval.
ASD Disrupts Amadey Operation
The Australian Signals Directorate (ASD) successfully infiltrated the backend infrastructure of a criminal operating the Amadey malware. This intervention led to the disconnection of approximately 180,000 infected computers worldwide, including some within Australia, from the criminal's control.
Tauri Gregory, ASD's acting deputy director-general of intelligence, confirmed that operators disconnected the Amadey controller from its victims. This action prevents the criminal from issuing new commands or stealing additional data from the compromised machines.
Understanding Amadey Malware
Amadey is a malware-as-a-service tool, first sold to criminals in 2018. Each buyer manages their own control panel and servers. Infected computers connect to these command-and-control (C2) servers to receive instructions.
The primary function of Amadey is to install further malicious software, such as the StealC infostealer. It can also steal user credentials and provide remote access to the compromised system. Common infection vectors include fake software updates and cracked software installers.
Broader Context and Limitations
While this operation neutralizes one Amadey botnet, ESET has identified 53 separate Amadey botnets that operate independently. Disconnecting a controller does not reverse prior data theft; stolen credentials can be used months later, and stolen session cookies can bypass multi-factor authentication.
ASD's offensive cyber operations are subject to explicit Australian government approval. This specific operation was not detailed in ASD's annual cyber threat report published on the same day.
Related International Efforts
Amadey's infrastructure was also targeted in June by Operation Endgame, an international law enforcement initiative involving private partners. This operation disrupted servers linked to Amadey, StealC, and SocGholish malware between June 15 and 19. Australia is one of nine countries participating in Operation Endgame, though its specific involvement in the June action week was not mentioned by Europol.
✨ This summary was generated by AI from the outlets' reporting listed below. It is not independently verified and may contain errors — check the original sources. How BrevFeed works →
The daily brief
One email each morning: the day's tech stories, clustered across outlets and summarized. No account needed.
One email a day. Unsubscribe in one click, any time.
Today's brief
Spend a few minutes, get the whole day. Every topic's top stories in one hands-free rundown — listen, watch, or read the transcript.
▶ Play today's brief
New every morning, and the back catalogue is archived by date.
Reporting from
The Australian Signals Directorate (ASD) gained access to an Amadey malware operator's backend and disconnected 180,000 infected computers globally. This action prevents the criminal from accessing or stealing data from these machines, though previously stolen credentials may still be at risk.