Australia’s Spies Unplug an Amadey Botnet From 180,000 PCs
Australia's ASD broke into an Amadey malware control panel and disconnected it from about 180,000 infected computers. Data already stolen is still out there.
Australia’s signals intelligence agency broke into a criminal’s Amadey malware control panel and cut it off from about 180,000 infected computers worldwide, some of them in Australia. Tauri Gregory, ASD’s acting deputy director-general of intelligence, described the operation to ABC News on Oct. 27, The Hacker News reports. ASD also said it destroyed a 5 TB stash of stolen business data, including an estimated 4.8 million records on Australians, before it could be sold.
For defenders
What Amadey is: a malware-as-a-service loader sold since 2018. Each buyer runs a separate control panel, and ESET has counted 53 separate Amadey botnets with no shared infrastructure, so this operation took down one of many. Amadey mostly installs other malware, notably the StealC infostealer, and can also steal credentials and give remote access. It usually arrives through fake updates, cracked software and other loaders.
What the takedown doesn’t do: Disconnecting the controller stops new instructions, but it doesn’t clean infected machines or take back anything already stolen. Credentials and session cookies grabbed by StealC can sit unused for months, and a stolen session cookie can get around MFA. ASD hasn’t said whether victims will be notified, and its annual threat report, published the same day, doesn’t describe the operation.
Context: Operation Endgame partners hit Amadey, StealC and SocGholish servers in June. Australia is one of the countries in that alliance, but this was a separate ASD action, which requires explicit government approval.
What it means for you
Amadey usually gets onto a computer when someone installs pirated software or a fake “update” from a pop-up. If yours was one of the 180,000, the criminals can no longer give it orders, but anything they already stole, such as saved passwords and logged-in sessions, is still out there. A security scan cleans the computer; it doesn’t change the passwords that were taken.
Do this now
- If you’ve installed cracked software or an update from a pop-up recently, run a full scan with Microsoft Defender or another reputable antivirus.
- If anything turns up, change passwords for email, banking and work accounts from a clean device, and sign out of all active sessions.
- Turn on two-factor authentication for important accounts, preferably an authenticator app or passkey.
- Get software only from the vendor’s site or an official app store.