ASD Breaks Into Amadey Backend, Cuts 180K Infected PCs

Published: 27 October 2026  |  Last reviewed: 27 October 2026

The Australian Signals Directorate gained access to an Amadey malware operator's backend infrastructure, then severed that criminal's connection to 180,000 victim machines around the world — one of the most concrete examples yet of Australia using its offensive cyber powers against organised cybercrime.

What Is Amadey, and How Does It Work?

Amadey is a Windows-targeting malware loader and information-stealing bot that has been sold as a service on dark web forums since October 2018. A buyer purchases access, runs their own control panel on their own infrastructure, and uses Amadey to drop additional payloads onto victim machines or to steal credentials and take remote screenshots.

The service has historically been priced at $600 per license with an additional $50 per rebuild, according to ESET's technical analysis published during Operation Endgame [1]. Each buyer runs their own command-and-control (C2) infrastructure, which is why disrupting one operator doesn't dismantle the whole ecosystem.

Infected computers check in periodically with their buyer's C2 server and wait for orders. Amadey's most common job is to drop additional malware — particularly the StealC infostealer, which harvests browser credentials, session cookies, cryptocurrency wallet data, and saved passwords from dozens of applications. Beyond that, Amadey itself can capture screenshots, monitor clipboard contents, and open a remote desktop connection.

Fake cracked software is the most visible distribution vector. The ASD specifically noted one case where Amadey was found hidden inside a free, illegitimate version of Photoshop editing software [2]. One copy was being sold on the dark web for around $500, which gives some sense of the commodity pricing in this market — Amadey service licenses and the data it produces both carry established prices.

What makes Amadey distinctive as a threat is not its sophistication but its modularity and persistence. The core bot reports system fingerprint data to the C2 server, which then sends back commands — download this DLL, run this script, grab the clipboard, open a VNC session. It is designed to be reconfigured per campaign, which is why ESET found 53 distinct Amadey botnets operating without shared infrastructure [3]. Each buyer runs their own operation independently.

What Exactly Did ASD Do, and How?

ASD's offensive cyber operators, acting under Australian Government authorisation, accessed the backend of a specific Amadey criminal operation, determined that operator had active control over 180,000 infected machines worldwide, and then severed that operator's C2 connection to all of those victims. The criminal's ability to issue commands to, or steal data from, those 180,000 computers was cut off.

"The next steps that we took were to disconnect that Amadey controller from all those victims," Tauri Gregory, ASD's acting deputy director-general of intelligence, told ABC News in an interview published on 27 October 2026 [2]. "And so, effectively, that cyber criminal can no longer access those 180,000 computers and no longer steal data from all those people."

ASD's offensive cyber operations require explicit approval from the Australian Government and can target cybercriminals overseas by disabling their infrastructure [4]. The agency has had this mandate for years, but cases where ASD publicly describes accessing a criminal's backend are rare. The timing of this disclosure — alongside ASD's 2025-26 annual cyber threat report — appears deliberate: the agency wanted Australians to see what offensive operations actually look like in practice.

ASD's report, also released on 27 October 2026, does not separately describe the Amadey operation, but the oral disclosure from Gregory to ABC News confirmed it [3]. The annual report noted a 20% jump in cybersecurity incidents the agency was required to respond to over the past financial year, which gives context for why ASD is talking more openly about its offensive activity.

How Does This Fit Into the Broader Operation Endgame Campaign?

Operation Endgame is an ongoing international law enforcement effort involving nine countries' judicial and law enforcement authorities, coordinated through Europol, that targets the initial-access malware infrastructure used to launch ransomware, financial fraud, and critical infrastructure attacks. The Amadey and StealC disruption in June 2026 was its most recent major action before ASD's October disclosure.

Australia is listed as one of Operation Endgame's nine participating countries, though the Europol announcement of the June 2026 action week — which ran from 15 to 19 June — did not specifically name Australia or ASD as participants in that phase [3]. The ASD operation Gregory described appears to be a separate, bilateral action rather than part of the June coordinated week.

The June 2026 action was significant on its own terms. Law enforcement and private partners including Bitdefender, Bitsight, ESET, and Microsoft dismantled 326 servers and 142 domains tied to Amadey and StealC, recovered 27 million stolen login credentials, and flagged over $47 million in cryptocurrency assets of criminal origin for restriction [5]. Microsoft separately identified more than 140,000 infected computers linked to Amadey and StealC in just the first two weeks of May 2026, and flagged 200 malicious C2 domains and IP addresses for shutdown.

The scale gap between the two actions is worth noting. The June Endgame phase hit the infrastructure of the broader Amadey ecosystem — dozens of operators across 53 separate botnets, according to ESET's tracking. The ASD's October action targeted one specific operator's setup. That single operator still had access to 180,000 machines, which illustrates both how active Amadey remains after the June disruption, and how many individual criminal operations are running independently under the MaaS model.

For those interested in how defenders detect and respond to malware like Amadey, the approach described in ASD's operation — gaining backend access and cutting off C2 communications — is a form of EDR-level threat hunting and infrastructure disruption that complements what enterprise defenders can do on the endpoint side.

What Was the Second Operation ASD Described?

In a separate case, ASD received a tip that 5 terabytes of data stolen from a business were being offered for sale on the dark web. The business was unaware it had been compromised. ASD located the data and destroyed it before it could be sold — including approximately 4.8 million files stolen from Australians and hundreds of thousands from victims in other countries.

Gregory described this operation at the same ABC News briefing. The stolen data included business documents, personal information, login credentials, and passwords. ASD "broke in" — Gregory's phrasing, noting the agency's offensive access capabilities — and destroyed the files before they could be monetized [2].

This kind of pre-sale destruction is striking. ASD is claiming it reached into infrastructure controlled by criminals — likely overseas — accessed stored data, and deleted it. The legality and technical method are not described in public reporting, but it is consistent with ASD's stated offensive mandate, which includes disrupting adversaries' operations before harm is done rather than only responding after the fact [4].

What Should Australian Individuals and Organisations Do Now?

If your systems were among the 180,000 affected by the Amadey operator ASD disconnected, or if you were part of the broader Amadey/StealC ecosystem disrupted in June 2026, the most urgent step is credential rotation — not just passwords, but any session tokens and API keys stored in browsers. Amadey's primary payload is credential theft, and what was already stolen before the C2 was cut off remains in circulation.

In practical terms, here is where organisations should focus:

• Check for infostealer infection indicators. Amadey spreads via fake installers and cracked software. If employees have installed unauthorised software recently, endpoint scans for Amadey and StealC are warranted. Modern EDR/XDR solutions should detect Amadey's C2 beacon pattern.
• Rotate credentials for any accounts accessible on potentially exposed machines. This includes corporate SSO accounts, email, admin panels, and cloud services. Session cookies are particularly important — a stolen cookie lets an attacker authenticate as you without needing your password or MFA code.
• Enable phishing-resistant MFA. Session cookie theft is one of the ways attackers bypass conventional TOTP-based MFA. FIDO2-based authentication and conditional access policies provide stronger protection against this type of post-theft abuse.
• Audit software installation sources. Amadey's most documented delivery method is cracked or fake software. Organisations should enforce policies preventing installation from unofficial sources and should deploy software allowlisting on high-risk endpoints.
• Don't assume the C2 disruption means machines are clean. The ASD's action disconnected the operator. It did not remove Amadey from victim machines or recover stolen data that was already exfiltrated.

Understanding how infostealers bridge into more serious attacks is also important context. Amadey is often described as a loader for ransomware campaigns. Stolen credentials from Amadey's StealC payload can be used weeks or months later to access corporate networks. Reviewing your incident response plan now — before a credential-theft event escalates — is a reasonable step.

What This Actually Tells Us About Offensive Cyber Operations

ASD's willingness to describe these two operations publicly is worth examining. The agency has had offensive cyber authority for years, and has used it before, but public acknowledgement of specific operations — especially one that involved accessing a criminal's backend system — is uncommon. The context here matters: ASD's director-general was simultaneously warning that AI is accelerating the scale and severity of attacks, and noting a 20% rise in incidents requiring ASD response in 2025-26.

Disclosing operations like the Amadey backend access serves a few purposes. It demonstrates deterrent value — criminal operators now know ASD can reach their infrastructure. It also builds a public case for ASD's budget and mandate at a time when the agency is pushing for more resources to respond to AI-enhanced threats.

The limitation is real, though. Cutting one operator off from 180,000 machines is meaningful, but ESET counted 53 separate Amadey botnets during its Operation Endgame research. The broader Amadey service — the advertised MaaS offering that has been active since 2018 — remains operational. The June 2026 Endgame action week hit the infrastructure hard, but samples of Amadey were still being observed in September 2026 according to ANY.RUN's malware tracking. Neither the June nor the October action shut down the Amadey service itself.

This is a pattern that repeats across law enforcement actions against MaaS operations: you can disrupt, seize infrastructure, and disconnect operators, but the service model means new instances can spin up on new servers. The credentials stolen before any given disruption action remain in criminal ecosystems. The question defenders should ask is not "has Amadey been stopped?" but "are our accounts and systems resilient against credentials that were already taken?"

For organisations thinking about their broader vulnerability management approach in this environment, the Amadey case is a useful reminder that initial access most often comes through commodity channels — fake software, phishing, cracked tools — not through novel zero-days. Defending against Amadey-class threats is primarily a matter of endpoint hygiene and credential security, not advanced threat detection.

Strategic Implications

Australia's disclosure of the Amadey backend operation is notable not primarily for its technical scale — 180,000 machines disconnected from one operator is significant but limited in the context of a 53-botnet ecosystem — but for what it signals about how ASD intends to use its offensive mandate. The agency is moving toward proactive disruption of criminal infrastructure, not just incident response and advisory work.

The decision to publicly describe accessing a criminal's backend and cutting their C2 connections is a deliberate deterrent message. It tells the broader criminal market that Australian targets are backed by an agency willing to counterattack. Whether that deters Amadey operators from targeting Australia, or simply pushes them to improve operational security, remains to be seen.

More instructively, the second operation described — destroying 4.8 million stolen files before they could be sold — represents a different type of intervention. Rather than merely watching a data exfiltration play out and notifying victims afterward, ASD claims to have reached the point of sale and destroyed the inventory. If accurate, that is a significant escalation of what "defensive" cyber operations can encompass. It is also an area where the technical and legal questions are most opaque: whose infrastructure did ASD access, under whose jurisdiction, and by what method?

For Australian defenders and policy watchers, the clearest takeaway is that ASD's appetite for publicly acknowledged offensive operations is growing. Paired with the 20% rise in incident volume and ASD's warnings about AI-accelerated threats, this suggests the agency is trying to reset public expectations about what fighting cybercrime actually involves — not just patching systems, but penetrating criminal networks.

Sources & References

1. ESET WeLiveSecurity — "ESET takes part in Operation Endgame to disrupt Amadey and StealC" (24 June 2026)
2. ABC News — "Disruptions 'inevitable' as AI-powered cyber threats grow, Australian Signals Directorate says" (27 October 2026)
3. The Hacker News — "Australia Gets Into Amadey Malware Backend, Cuts Off Access to 180,000 Infected Computers" (27 October 2026)
4. Australian Signals Directorate — "Offensive Cyber" (official ASD page)
5. The Hacker News — "Amadey and StealC Malware Network Disrupted, 27M Stolen Credentials Recovered" (24 June 2026)