Australia’s cyber intelligence agency has disrupted a cybercriminal operation using Amadey malware, cutting off a criminal controller from approximately 180,000 infected computers worldwide, including devices in Australia.
The Australian Signals Directorate (ASD) gained access to the operation’s backend infrastructure and disconnected the command-and-control server from infected machines, preventing the criminal behind the operation from continuing to control those devices through the compromised infrastructure.
“The next steps that we took were to disconnect that Amadey controller from all those victims,” Tauri Gregory, ASD’s acting deputy director-general of intelligence, told ABC News in an interview published on October 27.
The ASD is Australia’s foreign signals intelligence and cybersecurity agency. Its offensive cyber operations require explicit Australian government approval and can target criminal infrastructure overseas to disrupt cyberattacks.
Amadey is a malware family that has been sold to cybercriminals as a service since 2018. According to cybersecurity company ESET, the malware operates through separate control panels hosted on servers controlled by individual customers. Researchers have identified dozens of independent Amadey botnets operating without shared infrastructure.
Once a computer is infected, Amadey connects to its operator’s command-and-control (C2) server to receive instructions. The malware is primarily used to deliver additional malicious software, including the StealC information-stealing malware. It can also collect login credentials and provide attackers with remote access to compromised devices.
Amadey infections have commonly been spread through fake software updates, cracked software installers, and other malware loaders. These techniques can trick users into running malicious files disguised as legitimate software or updates.
Disconnecting the controller prevents the criminal operator from continuing to issue commands through that infrastructure, but it does not automatically clean infected computers or reverse damage caused by previous attacks. Information stolen before the disruption may still be available to criminals.
Microsoft has warned that stolen credentials can remain unused for months before attackers exploit them. Stolen session cookies can also allow criminals to access accounts without completing multi-factor authentication (MFA), depending on the session and the protections in place.
Amadey’s infrastructure has faced disruption before. In June 2026, Operation Endgame, an international law enforcement initiative working with private-sector cybersecurity partners, targeted servers associated with Amadey, StealC, and SocGholish malware. The operation’s action week ran from June 15 to June 19.
Australia is among nine countries whose law enforcement and judicial authorities participate in Operation Endgame. However, Australia was not included in Europol’s published list of countries participating in the June action week, and the announcement did not mention the ASD’s latest operation.
The agency also disclosed a separate case involving approximately five terabytes of stolen data offered for sale online. ASD received a tip about the data and discovered that the affected business was unaware its systems had been compromised.
The stolen information included business documents, personal information, login credentials, and passwords. ASD said it accessed the criminal operation and destroyed the data before it could be sold.
The files reportedly included an estimated 4.8 million records stolen from Australians, along with hundreds of thousands of records belonging to victims in other countries.
The ASD’s annual cyber threat report for 2025–26 was published on October 27, although the report does not describe the Amadey disruption operation.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
