Australia disrupts Amadey malware network, cutting off 180,000 PCs

Australia’s foreign signals agency has halted the Amadey malware operation by taking control of the attacker’s backend and severing connection to about 180,000 infected machines worldwide, including some in Australia. The Australian Signals Directorate (ASD) said its operators disconnected the Amadey controller from all victims, effectively stopping data theft and attempted remote access from those compromised hosts.

ASD’s acting deputy director-general of intelligence, Tauri Gregory, told ABC News that the next step was to “disconnect that Amadey controller from all those victims.”

Amadey, which has operated as a service bought by criminals since 2018, relies on each buyer running its own command-and-control (C2) panel. Infected computers check in with their buyer’s C2 server and execute orders to install additional malware, such as the StealC infostealer, harvest credentials, and provide remote access. The main infection paths include fake software updates, cracked software installers and other loaders.

ESET has identified 53 separate Amadey botnets in its tracking, noting they did not share infrastructure. Microsoft’s analysis warned that stolen credentials and session cookies can enable attackers to bypass multi‑factor authentication even after a controller is disconnected. The ASD’s own annual threat report published on 27 October does not describe the Amadey operation.

ASD notes that its Endgame operation, a law-enforcement initiative with international partners, disrupted Amadey infrastructure in June 2026. Europol confirmed the broader global scope of Endgame, adding Australia as a participating country, though the European agency’s list did not call out ASD specifically.

Separately, ASD reported a tip-off that 5 terabytes of stolen business data were up for sale; the agency reportedly destroyed the data before it could be sold, including about 4.8 million files stolen from Australians and hundreds of thousands from victims elsewhere.