Skip to content
Brief Security & Trust ·

Australia says it cut one criminal's Amadey malware off from 180,000 computers

Australia's signals agency says it disconnected one Amadey operation from its victims, but the sources do not say the infections were removed.

In brief
  • The Australian Signals Directorate says it cut one Amadey operation off from 180,000 infected computers. The sources report a disconnection, not a cleanup.
  • Stolen credentials can sit unused for months, so a takedown does not undo earlier theft.

The Australian Signals Directorate (ASD) says it broke into the backend of one criminal's Amadey operation and cut that operation off from 180,000 infected computers, some in Australia. ASD intelligence official Tauri Gregory told ABC News on October 27 that the team disconnected the controller from all those victims. Amadey is sold to criminals as a service. Each buyer runs its own control server. Infected computers check in there and follow orders, mainly installing more malware such as the StealC data thief.

The sources report a disconnection, not a cleanup. They do not say the infections were removed, so the malware may still sit on those computers. They also do not name the criminal or say when this happened. ASD's yearly threat report, out the same day, leaves the operation out. ESET counted 53 Amadey botnets that share no infrastructure, so this was one of many. Europol's June Operation Endgame announcement does not mention ASD.

A takedown like this changes who can give orders. It does not change what is on the machines or what was already stolen. Microsoft's analysis says stolen credentials can sit unused for months, and a stolen session cookie can bypass multi-factor authentication. Check whether any of your computers were infected, and whether passwords and sessions from them were reset.

A WebPulse Brief: a short report of an important event, written by the WebPulse Newsroom with AI assistance and checked against the reporting below. When there is more to explain, we follow up with a full story. How we use AI.

Reporting: The Hacker News.