Australia’s Cyber Agency Broke Into an Amadey Malware Operation and Cut Off 180,000 Infected Computers. Why That Is Not the End of the Story for Victims
The Australian Signals Directorate says its operators got into the backend of a criminal Amadey malware operation and disconnected it from about 180,000 infected computers worldwide. That stops new orders from reaching those machines, but it does not undo what was already stolen.
Somewhere among roughly 180,000 computers around the world, a criminal’s malware went quiet. The Australian Signals Directorate (ASD), the country’s signals intelligence and cyber security agency, says its operators gained access to the backend of an operation running the Amadey malware and disconnected that controller from every machine it was talking to. Some of those computers were in Australia.
This account is based on The Hacker News’ report on the ASD operation, which draws on an interview ASD’s acting deputy director-general of intelligence, Tauri Gregory, gave to ABC News, published on October 27.
A loader for hire
Amadey has been sold to criminals as a service since 2018, according to analysis by ESET. Each buyer runs its own control panel on its own servers, which is why ESET has tracked 53 separate Amadey botnets that share no infrastructure. The one ASD disrupted was one of many.
Infected computers check in with their buyer’s command server and follow its instructions. Amadey’s main job is to install more malware, such as the StealC information stealer, though it can also steal credentials and give the buyer remote access. It usually arrives through fake software updates, cracked software installers or other malware loaders.
ASD’s offensive cyber operations require explicit government approval, and they let the agency disrupt criminals overseas by disabling their infrastructure. Amadey had already been hit once this year: between June 15 and 19, the international Operation Endgame targeted servers tied to Amadey, StealC and SocGholish. Australia is one of the nine countries that run Endgame together, but it was not on Europol’s list of countries in that June action, and the announcement does not mention ASD.
A second operation: destroying stolen data before the sale
ASD also described a separate case. After a tip that 5 terabytes of data stolen from a business were up for sale, the agency broke in and destroyed the data before it could be sold. The haul included business documents, personal data and login credentials, with an estimated 4.8 million files stolen from Australians and hundreds of thousands more from victims in other countries. The business itself did not know it had been hacked.
What the disconnection does, and what it does not
It does:
- Stop that controller from sending new instructions to the 180,000 machines.
- Stop that criminal from using those machines to pull more data or install more malware.
It does not:
- Remove Amadey, or anything it already installed, from the infected computers.
- Undo earlier theft. Microsoft has noted that credentials taken by infostealers can sit unused for months before being used.
- Protect accounts whose session cookies were stolen. A stolen session cookie can let an attacker get past multifactor authentication.
- Affect the dozens of other Amadey botnets run by other buyers.
ASD’s annual cyber threat report, also published on October 27, does not describe the operation.
What this means for your company
Government takedowns are good news, but they are cleanup at the criminal’s end, not yours. Loader malware like Amadey gets in when someone installs a fake update or a cracked program, so the first layer is controlling what software staff can install. If a machine is ever found infected with a loader or infostealer, treat every password and browser session used on it as stolen: rebuild or thoroughly clean the device, reset passwords, and sign the user out of all sessions so stolen cookies stop working. Endpoint detection that is actually watched, and alerts on unusual sign-ins, help you find the problem before a stranger sells your data.
Need help checking your devices for infostealers and locking down accounts after an infection? Reach out to Layer 7 Data Solutions to discuss how we’ve helped companies similar to yours.
About The Author
