Australia Disrupts Amadey Malware Operation, Cutting Off 180,000 Infected Computers

Australia’s cyber intelligence agency has disrupted an Amadey malware operation by accessing its backend infrastructure and disconnecting approximately 180,000 infected computers worldwide from the criminal controller.

Australia has announced a significant cybercrime disruption after the Australian Signals Directorate (ASD) gained access to a criminal operation’s backend and cut off its control over infected devices. The operation targeted an Amadey malware controller used to manage compromised computers and potentially facilitate further cyberattacks.

According to a report published on October 27, 2026, the disruption affected approximately 180,000 infected computers worldwide, including devices in Australia.

How the Amadey Malware Operation Worked

Amadey is a malware family that has been offered to cybercriminals as a service since 2018. According to security researchers at ESET, different operators can run separate Amadey botnets using their own infrastructure.

The malware primarily functions as a loader, allowing attackers to deploy additional malicious software on compromised systems. It can also collect credentials and provide remote access to infected computers.

Common infection methods include fake software updates, cracked software installers, and other malware loaders. These methods can trick users into installing malicious programs disguised as legitimate applications.

Once infected, a computer communicates with an attacker’s command-and-control (C2) server, which can issue instructions and coordinate malicious activities.

Australian Cyber Agency Cuts Off Criminal Control

The ASD reportedly gained access to the criminal operation’s backend infrastructure before disconnecting its controller from the affected devices.

Tauri Gregory, ASD’s acting deputy director-general of intelligence, described the disconnection in an interview with ABC News published on October 27.

The operation demonstrates how authorised offensive cyber capabilities can be used to disrupt criminal infrastructure beyond Australia’s borders. Such operations require explicit Australian government approval.

However, disrupting a controller does not necessarily mean that every infected computer has been cleaned or that previously stolen information has been recovered.

Stolen Credentials Remain a Security Risk

One of the most important concerns associated with infostealer malware is the continued misuse of stolen information after an infection has been disrupted.

According to Microsoft’s analysis of Amadey and StealC, attackers may retain stolen credentials for extended periods before attempting to use them. Stolen session cookies can also enable attackers to bypass some multi-factor authentication protections.

Organisations and individuals who suspect an infection should therefore investigate beyond the immediate malware threat.

Recommended defensive actions include:

• Run reputable endpoint security scans and investigate suspicious activity.
• Change potentially compromised passwords from a trusted, clean device.
• Revoke active sessions and refresh tokens where supported.
• Enable multi-factor authentication, preferably using phishing-resistant methods.
• Review account activity and monitor for unauthorised access.
• Patch operating systems, browsers, and installed applications.

Connection to International Malware Disruption Efforts

The incident follows Operation Endgame’s June 2026 disruption of infrastructure associated with Amadey, StealC, and SocGholish. That international initiative involved law enforcement and private-sector partners targeting malware networks.

The report also describes a separate ASD intervention involving approximately five terabytes of stolen business data offered for sale. The agency reportedly destroyed the data before it could be sold, including millions of files containing information associated with Australians and other international victims.

Conclusion

Australia’s disruption of the Amadey malware controller highlights the importance of coordinated cyber operations, threat intelligence, and international cooperation against cybercrime.

Although disabling criminal infrastructure can reduce attackers’ ability to control infected devices, organisations must still investigate potential compromise and address exposed credentials. Effective endpoint protection, timely patching, secure authentication, and incident response remain essential for reducing the impact of information-stealing malware.

Source: The Hacker News, Australia Gets Into Amadey Malware Backend, Cuts Off Access to 180,000 Infected Computers.