Australia Hacked Back Against Amadey Malware, Severing 180,000 Infected Machines From Criminal Control
Australia's signals intelligence agency quietly pulled off something fairly notable: breaking into the backend of an Amadey malware operation and cutting off the criminal's access to around 180,000 compromised computers worldwide.
The Australian Signals Directorate confirmed the operation in an interview with ABC News on October 27. Tauri Gregory, ASD's acting deputy director-general of intelligence, explained that once they were inside the attacker's infrastructure, they severed the connection between the command-and-control server and all those victim machines. Simple, if you can get in.
ASD sits at the intersection of foreign signals intelligence and offensive cyber capability. Unlike law enforcement agencies, it can reach beyond Australian borders to disrupt criminal infrastructure, provided the government signs off on it first.
Amadey has been a fixture of the malware-as-a-service market since 2018. Criminals buy access, run their own control panel, and point it at infected machines that dutifully check in for instructions. The main use case is dropping additional malware, most commonly StealC, an infostealer designed to hoover up credentials and session cookies. It also offers remote access as a bonus. Distribution typically came through fake software updates, dodgy cracked installers, and other loaders. Standard stuff.
ASD's target was one operator among many. ESET's research tracked 53 distinct Amadey botnets operating independently with no shared infrastructure, so this takedown nicked one slice of a larger pie.
Worth being clear on what disconnecting a C2 server actually achieves. It stops further commands reaching victim machines, which is useful. What it does not do is undo anything that already happened. Stolen credentials and session cookies can sit dormant for months before anyone uses them. A hijacked session cookie can bypass MFA entirely, so anyone whose machine was previously infected should not feel suddenly safe.
ASD's annual cyber threat report, also published on October 27, makes no mention of this operation.
Amadey's infrastructure had already taken a hit earlier in the year. Operation Endgame, the international law enforcement coalition that runs periodic disruption actions with private sector partners, targeted servers tied to Amadey, StealC, and SocGholish during a five-day action in June. Australia is formally one of nine countries in the Endgame coalition, though it did not appear on Europol's list of participants in that specific June operation, and ASD was not mentioned.
In a separate incident disclosed the same day, ASD described receiving a tip that five terabytes of stolen data were being offered for sale on criminal forums. The victim organisation had no idea it had been breached. ASD broke into the storage and destroyed the files before any sale could complete. Among the deleted data: an estimated 4.8 million records belonging to Australians, plus hundreds of thousands more from victims in other countries.
Two operations, zero press conferences until now. ASD is apparently comfortable doing its work quietly.