A botnet cut at the control layer
Australia’s Signals Directorate has disclosed that its operators accessed the backend of an Amadey malware operation and cut a criminal operator off from 180,000 infected computers around the world, including systems in Australia . The move did not merely advise victims to clean individual devices; it severed the command-and-control link that allowed the botmaster to keep reaching compromised machines .
ASD acting deputy director-general of intelligence Tauri Gregory told ABC News that the agency disconnected the Amadey controller from “all those victims,” leaving the criminal unable to access the 180,000 computers or continue stealing data through that channel . The Hacker News, reporting on the same disclosure, described the operation as backend access followed by a cut-off from the infected computers .
That distinction matters. In a typical endpoint response, each infected computer must be found, isolated, wiped or remediated, and its accounts reset. ASD’s intervention targeted the criminal infrastructure that coordinated the botnet. In practical terms, the operator’s admin panel may still exist somewhere, but its relationship with this victim pool has been broken. The panel’s victims have gone dark.
What Amadey was doing
Amadey is not a flashy one-off exploit. It is commodity crimeware used to establish a foothold, steal information and deliver additional malware . ABC reported that ASD had seen Amadey hidden inside free software, including an illegitimate copy of Photoshop, and had found it advertised on the dark web for about US$500 .
The Hacker News, citing ESET’s analysis, said Amadey has been sold to criminals as a service since 2018, with each buyer running a separate control panel on separate infrastructure . That explains both the power and the limitation of the Australian action: ASD appears to have cut off one criminal operation, not erased every Amadey deployment everywhere .
Once installed, Amadey-infected computers check in with a command-and-control server and follow orders from the buyer operating that server . Those orders may include installing more malware, such as the StealC infostealer, stealing credentials directly, or enabling remote access to the machine . The common delivery paths include fake software updates, cracked installers and other malware loaders .
For victims, the infection is often invisible until the stolen data is abused. A user who installs a pirated design tool may not realise that browser passwords, cookies, email logins or business credentials have been harvested. A company may see only the later symptom: a strange login, a fraudulent invoice, a ransomware intrusion, or a leak listing on a criminal marketplace.
Why severing the controller is a strategic move
The central lesson is that ASD acted at infrastructure scale. Instead of chasing 180,000 machines one by one, the agency removed the controller’s access to the fleet . That is a defensive outcome delivered through an offensive cyber operation.
The Hacker News noted that ASD’s offensive cyber operations require explicit Australian government approval and can be used to disrupt overseas cybercriminal infrastructure . ABC’s reporting placed the Amadey disclosure inside a broader description of ASD’s offensive work against criminals hoarding or selling personal data on the dark web .
This kind of operation changes the economics for criminals. A botmaster normally profits because a large pool of infected computers can be reused: today for credential theft, tomorrow for a loader campaign, later as access for fraud or extortion. If a state agency can enter the backend and disconnect the controller, the operator loses not just a server but the monetisable relationship with every machine checking in.
It also reduces harm for people who may never know they were infected. Gregory said that without ASD’s action, data from 180,000 businesses or individuals could have been stolen, sold, monetised in other ways, or used for follow-on crimes such as fraud and identity theft . The operation therefore functioned as a pre-emptive protective act for victims who were unlikely to remediate quickly on their own.
What the takedown does not prove
The disruption should not be misunderstood as a global Amadey cleanup. The Layman Security noted that ASD has not said when the operation took place beyond describing it as recent, nor how many of the 180,000 affected machines were in Australia . It also stressed that cutting the controller stops new theft from those machines but does not undo theft that happened before the cut-off .
That caveat is central for defenders. The Hacker News reported that stolen credentials harvested by infostealers may sit unused for months, and that stolen session cookies can allow attackers to bypass multi-factor authentication . In other words, even a successful backend disruption does not invalidate passwords, revoke browser sessions or re-image compromised endpoints by itself.
SECNEWS.co.uk made the same point for security teams: Amadey’s model means every buyer can run separate infrastructure, so one large disruption buys time but does not eliminate the broader ecosystem . The site also highlighted the defensive implication: organisations should hunt for infostealers, revoke active sessions as well as reset passwords, and stop relying on another party’s takedown .
The safest assumption for any organisation that finds Amadey indicators is that credentials, cookies and browser-stored secrets were exposed before the controller was disconnected. That response should include endpoint re-imaging, password resets, session revocation, checks for unauthorised mailbox rules, and review of cloud, VPN and SaaS login histories.
A second offensive action: stolen data destroyed
ASD also described a separate operation involving 5 terabytes of stolen data from a business that did not know it had been hacked . According to ABC, the cache included sensitive business documents, personal information, logins and passwords, and ASD broke in and destroyed the data before it could be sold .
Gregory said ASD believed the destroyed material included about 4.8 million files stolen from Australians, plus hundreds of thousands of files from victims around the world . SECNEWS.co.uk treated that second case as a warning about detection failure: a business had lost a massive volume of data without noticing, and should not expect a government agency to delete stolen files on its behalf .
Together, the Amadey controller cut-off and the 5-terabyte data destruction case show a broader doctrine. ASD is not just responding after victims report incidents. It is looking for criminal infrastructure, stolen data stores and illicit marketplaces, then acting to prevent further harm where it has authority to do so.
Why defenders should still move
For security teams, the Australian operation is good news but not a reason to relax. It shows that government action can neutralise a major criminal node, but it also shows how many machines can remain silently enrolled in commodity malware networks. The number — 180,000 infected computers — is large enough to matter globally, yet it appears to represent one Amadey operator’s reach rather than the entire malware economy .
The immediate lessons are practical. Block cracked and unauthorised software on managed devices. Treat “free” installers and fake updates as high-risk. Monitor for infostealer behaviour, not just ransomware detonation. When an infostealer is detected, revoke sessions as well as resetting passwords, because an attacker may already have a valid cookie or token .
ASD’s intervention cut a criminal off from a huge victim pool. It did not make every compromised computer clean, nor did it erase every credential already stolen. The strongest reading of the story is therefore not that the problem is solved. It is that infrastructure-scale disruption can protect victims at speed — but only if endpoint recovery and identity hygiene follow close behind.
Comments
Be the first to comment.