- Australia's signals agency says it cut one criminal's Amadey malware off from 180,000 infected computers worldwide. The reports do not say the malware was removed.
- Cutting access stops further theft, not earlier theft. Microsoft's analysis, as cited by The Hacker News, says stolen credentials can sit unused for months.
- Ask whether staff can install cracked software on work devices, and whether you can quickly end stolen sessions as well as reset passwords.
A takedown stops theft, but the reports do not say victims were told
On October 27, the Australian Signals Directorate (ASD) gave ABC News an account of an operation against a criminal running Amadey malware. ASD says its operators reached the back end of that operation. They saw a network that stretched to 180,000 computers around the world, some of them in Australia.
Tauri Gregory, ASD's acting deputy director-general of intelligence, says the agency then cut the link between the Amadey controller and those machines. In his words, the criminal "can no longer access those 180,000 computers". These figures are ASD's own account.
The lesson here is about what a cut cord cannot do. It stops future theft. It cannot recall what left earlier. The reports do not say how much data was taken from these machines. They do not say whether the malware was removed. They do not say whether victims were told.
How Amadey works
Amadey is rented out rather than sold once. The Hacker News, citing ESET's analysis, says it was offered to criminals as a service in 2018. Each buyer runs a control panel on their own servers.
An infected computer contacts its buyer's server, known as a command-and-control or C2 server, and follows the orders it receives. The main task is to deliver further malware, such as the StealC infostealer, a program that harvests saved logins. Amadey can also collect credentials itself and let the buyer operate the machine remotely.
ABC reports that Amadey hides inside free software. In one ASD case it sat in an illegitimate copy of Photoshop. ASD also found it advertised on the dark web for about $US500. ESET, as cited by The Hacker News, names fake software updates, cracked installers and other malware loaders as the ways it spread. The reports do not rank those routes.
So cracked software is one route, as in ASD's Photoshop case. Fake updates and other loaders are others, and they need no one to go looking for a discount.
One buyer among many
ESET counted 53 separate Amadey botnets that shared no infrastructure, The Hacker News reports. ASD's operation reached one criminal's network. The reports do not say how many other operators are still running.
The Hacker News adds that police action in June, called Operation Endgame, hit servers linked to Amadey, StealC and SocGholish between June 15 and 19. Europol says Australia is one of nine countries running Endgame together. The June announcement does not mention ASD, and ASD's annual threat report does not describe this operation.
Why stolen logins outlive the takedown
The Hacker News cites Microsoft's analysis that credentials taken by infostealers can sit unused for months before attackers use them. A thief does not have to act on the day of the theft. A login taken today can be tried long after the infected machine is cut off.
The same report says a stolen session cookie can let an attacker bypass multi-factor authentication (MFA). A session cookie is a small token a website gives your browser after you sign in and pass the MFA check. It tells the site this person is already verified. Someone holding a copy of that token can present it and may never be asked for a code.
This is why ending sessions matters. That is our interpretation, not a finding in the reports. A password reset changes the key, but a session already granted may remain open until it is ended. Treat both steps as separate.
Mr Gregory framed the stakes this way. Without ASD's action, he said, data from 180,000 businesses or individuals was being stolen. It could be sold, monetised or used for fraud and identity theft. That describes the risk he sees, not a count of what was taken.
Not an AI story
In the same interview, ASD director-general Abigail Bradshaw said frontier AI models had "redefined" the threat. She cited a 20 per cent rise in incidents ASD had to respond to last financial year. Amadey is not described as an AI tool. It is a commodity product with a price tag, and the lesson here does not depend on AI.
What leaders should ask
First, can staff install unlicensed or cracked software on company devices? ASD's Photoshop case shows how that route works. Also ask how updates reach your devices, since fake updates are another route.
Second, if a device ran such software, could you reset passwords and end active sessions for every account used on it? Do it for sessions as well as passwords, because a stolen cookie may not need the password.
Third, who in your organisation would learn that a device was in a criminal's botnet, and how? The reports do not say whether ASD told victims. As prudence, plan on the assumption that no one will call. That is a planning choice, not a finding.
A government can cut a criminal's cord from its victims. The stolen logins keep their value long after, so the defence that matters is how fast you can make them worthless.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: Australian Broadcasting Corporation (ABC News), interview with the Australian Signals Directorate's Tauri Gregory.
