Malware · Threat Intelligence · Incident Response
Australia disrupts Amadey malware, cuts off 180,000 infected computers
Australia's cyber agency says it broke into a criminal's Amadey malware backend, disconnecting 180,000 infected computers worldwide from the attacker's control.
Ross Grant2 min read
The short version
A criminal used the Amadey malware to control 180,000 computers around the world. Australia's cyber agency says it broke into the attacker's system and stopped them from accessing these computers. The malware let attackers install more malicious software and steal information. This action should protect the affected computers from further harm.
By the numbers
- 180,000infected computers cut off from attackerThe Hacker News
- 5 terabytesstolen data destroyed before saleThe Hacker News
- 4.8 millionfiles stolen from Australians destroyedThe Hacker News
What happened?
Australia's cyber agency says it broke into a criminal's Amadey malware backend and cut off access to 180,000 infected computers worldwide, including some in Australia. The attacker can no longer control or steal data from these machines, according to the Australian Signals Directorate. Only The Hacker News has reported this so far, and there is no official statement from ASD.
Who is affected
According to the Australian Signals Directorate (ASD), a criminal using the Amadey malware lost access to 180,000 infected computers across the globe, including some in Australia. These computers were under the attacker's control until ASD intervened. Amadey is a type of malware that has been sold to cybercriminals since 2018, with each buyer running their own separate network of infected machines. ESET, a security firm, has tracked at least 53 distinct Amadey botnets, each operating independently.The Hacker News (opens in a new tab)
How the attack worked
Amadey typically spreads through fake software updates, cracked software installers, and other malware loaders. Once installed, it connects to a command-and-control (C2) server operated by the criminal. The malware can install additional malicious software, steal credentials, and give remote access to the infected machine. In this case, the ASD gained access to the attacker's backend system and cut off its ability to communicate with the 180,000 infected computers. This action stopped the criminal from issuing new commands or stealing more data from those systems.
The response
Tauri Gregory, acting deputy director-general of intelligence at ASD, told ABC News that the agency's operators "disconnected that Amadey controller from all those victims." The ASD is authorised to conduct offensive cyber operations, which can include disabling criminal infrastructure overseas. The agency's annual cyber threat report, published on the same day, does not mention this specific operation.
This is not the first time Amadey infrastructure has been targeted. In June, Operation Endgame, a joint law enforcement effort involving nine countries, disrupted servers linked to Amadey, StealC, and SocGholish malware. However, Australia's ASD was not listed among the countries participating in that action week, and the operation was not mentioned in Europol's announcement.
What was taken
In a separate case, the ASD said it received a tip about 5 terabytes of stolen data for sale, including business documents, personal data, and login credentials. The affected business was unaware of the breach. The ASD intervened and destroyed the data before it could be sold, including an estimated 4.8 million files stolen from Australians and hundreds of thousands from other countries.
So far, only The Hacker News has reported this operation, and there is no official statement or confirmation from ASD or other primary sources. The details are based on interviews and secondary reporting.
Why it matters
This case shows how government agencies can disrupt cybercriminal operations by targeting their control systems. Cutting off access to infected computers can prevent further attacks and data theft, protecting both individuals and businesses.
Key points
- Australia's ASD claims to have cut off 180,000 computers from Amadey malware control.
- Amadey spreads through fake updates, cracked software, and other malware loaders.
- The malware lets attackers install more malware and steal credentials.
- ASD says it also destroyed 5TB of stolen data before it could be sold.
- Only one outlet has reported this story so far, and there is no official confirmation.
Sources
The Hacker News
Reference
