Australian Agency Disrupts Amadey Malware Operation, Cutting Off 180,000 Infected Computers
The Australian Signals Directorate (ASD) has successfully disrupted the Amadey malware operation, severing a criminal's control over 180,000 infected computers globally.
The Australian Signals Directorate (ASD) has announced a significant disruption to the Amadey malware operation, effectively cutting off a cybercriminal's access to approximately 180,000 infected computers worldwide. The agency's offensive cyber operations team gained control of the malware's backend infrastructure, preventing further data theft and command-and-control (C2) communications.
Tauri Gregory, ASD's acting deputy director-general of intelligence, confirmed the operation's success, stating that the agency "disconnected that Amadey controller from all those victims." This action by the ASD, Australia's foreign signals intelligence and cybersecurity agency, highlights its capability to disrupt malicious operations overseas through government-approved cyber interventions.
Amadey, which was first observed being sold as a service to criminals in 2018, functions primarily as a malware loader. Its main purpose is to install other malicious payloads, such as the StealC infostealer, onto compromised systems. Beyond installing additional malware, Amadey is also capable of stealing credentials and granting attackers remote access to infected machines.
The malware typically infects computers through various deceptive methods, including fake software updates, cracked software installers, and other malware distribution chains. ESET's analysis has identified numerous distinct Amadey botnets, with the agency tracking at least 53 separate operations that do not share common infrastructure, underscoring the widespread nature of its use.
While the ASD's action prevents future data exfiltration and control, it does not undo the damage already caused. Credentials and sensitive data stolen prior to the disruption may still be in the hands of attackers. Microsoft's analysis indicates that stolen session cookies, for instance, can be used to bypass multi-factor authentication (MFA) and grant attackers persistent access.
This disruption by the ASD comes after a broader international law enforcement effort, dubbed Operation Endgame, which targeted Amadey and other malware families like StealC and SocGholish in June 2026. Operation Endgame involved coordinated actions against associated servers, demonstrating a global push to dismantle these criminal infrastructures.
In a separate but related incident, the ASD also reported intercepting and destroying approximately 5 terabytes of stolen data before it could be sold on the black market. This data, believed to have been exfiltrated from an unaware business, included sensitive business documents, personal information, and credentials, with an estimated 4.8 million records belonging to Australian victims.
The ASD's annual cyber threat report, released concurrently with the Amadey operation announcement, does not detail this specific intervention. However, the agency's proactive stance and successful disruption of the Amadey backend underscore the evolving landscape of cyber threats and the critical role of national cybersecurity agencies in combating them.