Australian Signals Directorate cuts off Amadey malware link to 180,000 infected computers

The Australian Signals Directorate said on Oct. 27, 2026 that a criminal using Amadey malware lost access to about 180,000 infected computers worldwide, including some in Australia, and can no longer steal data from them. ASD operators accessed the backend of the criminal’s Amadey operation and severed its connection to those computers. The Hacker News reported the agency’s disruption of the Amadey backend.

ASD serves as the Australian government agency responsible for foreign signals intelligence and cybersecurity. ASD’s offensive cyber operations require explicit approval from the Australian government. Those operations can disrupt overseas cybercriminals by disabling their infrastructure.

Tauri Gregory, ASD’s acting deputy director-general of intelligence, said in an ABC News interview published on Oct. 27, 2026 that the next steps were to disconnect the Amadey controller from all those victims. “The next steps that we took were to disconnect that Amadey controller from all those victims,” Gregory said.

Buyers have bought Amadey as a service starting in 2018, according to ESET’s analysis. Every buyer operates a separate control panel on separate servers. Machines infected with Amadey contact their buyer’s command-and-control server, the computer that sends orders to infected machines, to receive orders. ESET’s tracking found 53 separate Amadey botnets, networks of infected computers controlled together, with no shared infrastructure, and the criminal ran one of many Amadey operations.

Installing malware, including StealC infostealer, software that steals data from infected computers, is Amadey’s primary function. The malware steals credentials and grants the buyer remote access to the infected machine. Fake updates, cracked installers and other malware loaders most commonly delivered Amadey to computers.

Disconnecting the controller does not undo earlier theft. Microsoft’s analysis says stolen infostealer credentials can wait months before attackers use them. Attackers can bypass multifactor authentication, a login method requiring more than one proof of identity, using a stolen session cookie.

In June, Operation Endgame disrupted the infrastructure of the Amadey malware. Operation Endgame is a multinational police operation coordinated with private companies. The operation targeted servers tied to Amadey, StealC and SocGholish malware between June 15 and 19.

Europol’s June announcement says nine countries including Australia run Operation Endgame together through law enforcement and judicial authorities. That announcement omits Australia from the countries that participated in the June action week and does not mention ASD.

In a separate case, ASD said a tip indicated that 5 terabytes of stolen business data were for sale. The hacked business was unaware of the intrusion, and the stolen data contained business documents, personal information and login credentials with passwords. The agency entered the systems and destroyed the data before a sale could occur. ASD says the destroyed files included an estimated 4.8 million from Australians and hundreds of thousands from victims in other countries.

The operation is not described in ASD’s annual cyber threat report. ASD published that report on Oct. 27, 2026.