- What: The Australian Signals Directorate (ASD) got into a criminal's Amadey malware backend and disconnected its controller from 180,000 infected computers worldwide, including some in Australia.
- Impact: That operator can no longer steal from or control those machines, but credentials and session cookies taken before the takedown can still be used, and ESET has identified 53 separate Amadey botnets.
- Fix / mitigation: There is no vendor patch: the mitigation is ASD's takedown of this controller, plus earlier server disruption by Operation Endgame between June 15 and 19, and any data taken before then still needs to be treated as exposed.
- Who's at risk: Organizations whose users ran fake software updates, cracked installers, or other malware loaders, and any business whose staff credentials or session cookies may have passed through Amadey or StealC.
An Amadey operator lost access to 180,000 infected computers around the world, and Australia's Signals Directorate (ASD) is the reason. ASD's operators got into the backend of the criminal's operation and disconnected its controller from every victim. "The next steps that we took were to disconnect that Amadey controller from all those victims," Tauri Gregory, ASD's acting deputy director-general of intelligence, told ABC News in an interview published on October 27, as reported by The Hacker News.
This was not a court order or a domain seizure. ASD is Australia's foreign signals intelligence and cyber security agency, and its offensive cyber operations need explicit approval from the Australian government. They can disrupt cybercriminals overseas by disabling their infrastructure. In this case, a state intelligence agency entered a criminal's own control system and used it to let go of the victims.
What Amadey is and why one takedown has limits
Amadey has been sold to criminals as a service since 2018, according to ESET's analysis. Each buyer runs its own control panel on its own servers. Infected computers check in with that buyer's command-and-control (C2) server and carry out its orders. Amadey's main job is to install more malware, such as the StealC infostealer. It can also steal credentials and give the buyer remote access to the machine.
It mostly spread through fake software updates, cracked software installers, and other malware loaders. Those are user-driven infection paths, not exploits, so the defense depends on behavior and control rather than on patching.
The resale model is why this win has limits. ESET identified 53 separate Amadey botnets that did not share infrastructure. ASD took down one of them. The other operators kept running.
Cutting a controller off from its victims does not undo theft that already happened. Microsoft's analysis says credentials stolen by infostealers can sit unused for months before attackers use them, and a stolen session cookie can let an attacker bypass multi-factor authentication. The 180,000 machines are no longer reporting to this operator, but anything already taken from them may still be for sale.
A second operation, and a gap in the public record
Amadey's infrastructure had already been hit earlier this year. Between June 15 and 19, Operation Endgame, an international law enforcement effort that works with private partners, targeted servers associated with Amadey, StealC, and SocGholish. According to Europol's June announcement, Australia is one of nine countries whose law enforcement and judicial authorities run Operation Endgame together. However, Australia was not on Europol's list of countries that took part in the June action week, and the announcement does not mention ASD.
ASD's annual cyber threat report, also published on October 27, does not describe the Amadey operation either. Based on public sources, the ASD action appears to be a separate effort from the June Endgame week, and the details are coming from an interview rather than a formal disclosure.
The 5 terabyte case nobody knew about
ASD also described a separate case. It received a tip that 5 terabytes of data stolen from a business were for sale. The business did not know it had been hacked. The data included business documents, personal data, and login credentials and passwords. ASD broke in and destroyed the data before it could be sold. The destroyed files included an estimated 4.8 million stolen from Australians and hundreds of thousands taken from victims in other countries (the report does not say what unit the 4.8 million counts).
For many executives, the important detail here is not the destruction. It is that a government agency found out about the breach before the victim did.
In both operations the defensive action happened on the attacker's infrastructure, not inside the victims' networks. The victims did not take part. A business can benefit from a takedown like this without knowing it, and that also means it cannot count on one happening.
The RedEye take
This is a good operation and more governments should be doing this kind of work. Getting into a criminal's backend and freeing 180,000 machines is a strong result, and destroying 5 TB of stolen data before it reached a buyer likely prevented a lot of downstream fraud. Making offensive operations depend on explicit government approval is also the right model.
Still, security leaders should not read this story as "the threat was removed." Amadey is a product, and ESET counts 53 independent botnets built on it. The infostealer economy that Amadey supports runs on credentials and cookies that last longer than the infrastructure used to steal them. A takedown limits future harm from one operator. It does not cover the risk an organization picked up before the takedown. The organizations in the most danger are the ones in the same position as the 5 TB victim: compromised and unaware.
What defenders should learn
- Treat a takedown headline as the start of an exposure review, not the end of one. If an infostealer such as Amadey or StealC ever ran on a machine that a user logs into for work, the credentials and session tokens from that machine should be treated as compromised, regardless of what happened to the C2 server.
- MFA does not close the session-cookie gap. Microsoft notes that stolen session cookies can bypass MFA, so session lifetime and session revocation matter as much as the login prompt itself.
- The infection paths are cultural as much as technical. Fake updates and cracked installers rely on users who install software from wherever they find it, so personal and unmanaged devices that reach corporate apps are a real part of the attack surface.
- Plan for learning about a breach from outside. The 5 TB victim heard about its compromise from a government agency. Leaders should know in advance who takes that call, how it gets verified, and how quickly the organization can act on it.
- Factor the long delay into how long you watch for misuse. If stolen credentials can sit for months before use, your monitoring for unusual logins after a suspected infection needs to cover months, not days.
Source: The Hacker News, "Australia Gets Into Amadey Malware Backend, Cuts Off Access to 180,000 Infected Computers," October 27, 2026, https://thehackernews.com/2026/10/australia-gets-into-amadey-malware.html
Questions about your exposure?
RedEye Security provides assessments for organizations that need to understand their real risk.
Talk to us