ASD disconnected 180,000 computers from one Amadey controller

The Australian Signals Directorate got into the backend of one criminal’s Amadey operation and disconnected its controller from 180,000 infected computers around the world, including some in Australia. “The next steps that we took were to disconnect that Amadey controller from all those victims,” Tauri Gregory, ASD’s acting deputy director-general of intelligence, told ABC News in an interview published on October 27.

ASD is Australia’s foreign signals intelligence and cyber security agency. Its offensive operations need explicit government approval and can disrupt criminals overseas by disabling their infrastructure. The agency’s annual cyber threat report, also published October 27, does not describe the operation.

One backend, one buyer’s whole fleet

Amadey has been sold to criminals as a service since 2018, according to ESET. Each buyer runs its own control panel on its own servers. Infected machines check in with their buyer’s command-and-control server and carry out its orders. The malware’s main job is installing more malware, often the StealC infostealer; it can also steal credentials directly and give the operator remote access to the machine. It usually arrives through fake software updates, cracked software installers, and other malware loaders.

That architecture is what made the disconnect work and also what bounds it. A single buyer’s controller is the one point through which that buyer reaches every victim, so access to the backend drops all of them at once. The service model also means there is no single Amadey to take down. ESET tracked 53 separate Amadey botnets with no shared infrastructure. ASD reached one of them. The other operations run on their own servers and keep going.

What the disconnect leaves behind

Severing a controller from its victims stops new commands and new theft from that operation. It does nothing about data already taken. Credentials pulled by infostealers can sit unused for months before anyone logs in with them, according to Microsoft, and a stolen session cookie lets an attacker skip MFA. A host that was talking to this controller yesterday is still compromised today, with whatever was already exfiltrated still in criminal hands.

If some of those 180,000 machines sit in a fleet you run, the takedown is not remediation. Treat any host known to have run Amadey as fully compromised: reimage it, rotate every credential entered or stored on it, and invalidate active sessions rather than trusting MFA to hold. The gap between theft and use is long enough that waiting for a failed login is not detection.

Operation Endgame already hit it in June

Amadey’s infrastructure was disrupted once this year already. Between June 15 and 19, Operation Endgame, an international law enforcement effort that works with private partners, targeted servers tied to Amadey, StealC, and SocGholish. Australia is one of the nine countries whose law enforcement and judicial authorities run Operation Endgame, according to Europol’s June announcement, but it was not on Europol’s list of participants in the June action week, and that announcement does not mention ASD. The operation Gregory described is a separate action.

The data ASD destroyed

Gregory also described a second case. ASD received a tip that 5 terabytes of data stolen from a business were for sale, and the business did not know it had been hacked. The data included business documents, personal data, and login credentials and passwords. ASD broke in and destroyed the data before it could be sold. The destroyed files included an estimated 4.8 million stolen from Australians and hundreds of thousands taken from victims in other countries.