Australia’s national cyber security agency has disrupted a cybercriminal operation involving the Amadey malware, preventing criminals from accessing approximately 180,000 infected computers worldwide, including devices in Australia.
The Australian Signals Directorate (ASD) gained access to the criminal operation’s backend infrastructure and disconnected its control server from infected computers, cutting off the attacker’s ability to communicate with those devices through the affected system.
According to Tauri Gregory, ASD’s acting deputy director-general of intelligence, the agency took action to disconnect the Amadey controller from all affected victims. The operation was discussed in an interview published by ABC News on October 27.
What Is Amadey Malware?
Amadey is a malware-as-a-service platform that has been available to cybercriminals since 2018. It allows attackers to operate their own malware campaigns using dedicated servers and command-and-control infrastructure.
Once a computer becomes infected, Amadey connects to the attacker’s command-and-control (C2) server and receives instructions. The malware is primarily used to deliver additional malicious software, including information-stealing malware.
Depending on the attacker’s objectives, Amadey can also collect sensitive information, steal login credentials, and provide remote access to compromised computers.
How Does Amadey Infect Computers?
Cybercriminals commonly distribute Amadey through deceptive and malicious downloads. Some of the most frequently observed infection methods include:
- Fake software updates: Fraudulent update notifications trick users into downloading malware.
- Cracked software: Unofficial installers for pirated applications can contain malicious code.
- Malware loaders: Other malicious programs download and install Amadey onto compromised systems.
After infection, the malware establishes communication with the attacker’s infrastructure, allowing criminals to deliver additional payloads and potentially steal valuable information.
Disconnecting the Malware Server Disrupts Criminal Operations
By gaining access to the operation’s backend and disconnecting its controller, ASD disrupted the communication channel between the criminal and the affected computers.
However, this action does not necessarily mean that every infected computer has been cleaned or that all previously stolen information is safe.
Stolen credentials may remain useful to attackers long after the initial infection. Criminals can store compromised login details and use them months later to access accounts, systems, or business networks.
Stolen session cookies can also allow attackers to bypass certain multi-factor authentication (MFA) protections by reusing an already authenticated session.
For this reason, disconnecting a command-and-control server is an important disruption measure, but infected devices may still require investigation, malware removal, and security checks.
International Efforts Target Malware Infrastructure
The Amadey disruption follows other international efforts to weaken cybercriminal infrastructure.
In June, Operation Endgame targeted servers associated with several malware operations, including Amadey, StealC, and SocGholish. The international law enforcement initiative works with private-sector partners to disrupt malicious infrastructure and reduce the ability of cybercriminals to operate.
Australia is among the countries involved in the broader Operation Endgame initiative, according to a European law enforcement announcement. However, the public announcement of the June operation did not list Australia among the countries participating in that specific action week or identify ASD as a participant.
ASD’s annual cyber threat report, also published on October 27, did not provide details of the Amadey operation described in the interview.
Separate Operation Prevents the Sale of Stolen Data
In another cybercrime case, ASD received information that approximately five terabytes of stolen business data were being offered for sale.
The affected business was reportedly unaware that its systems had been compromised. The stolen information included corporate documents, personal information, usernames, passwords, and other login credentials.
ASD subsequently accessed the criminal infrastructure and destroyed the stolen data before it could be sold.
The agency estimated that the affected files included approximately 4.8 million records belonging to Australians, along with hundreds of thousands of records associated with victims in other countries.
The incident highlights the scale of information that cybercriminals can obtain during a successful attack and the potential consequences for both organizations and individuals.
How to Protect Your Computer From Malware
Although disrupting criminal infrastructure can limit the damage caused by malware, users and businesses should take additional precautions to protect their systems.
Recommended security measures include:
- Download software from trusted sources. Avoid unofficial installers, pirated applications, and suspicious download websites.
- Keep operating systems and applications updated. Install security patches promptly.
- Use multi-factor authentication. Enable MFA on important accounts, particularly email, financial services, and business systems.
- Change compromised passwords. If an infection is suspected, reset affected passwords from a clean device and revoke active sessions where possible.
- Scan potentially infected devices. Use reputable security tools and seek professional assistance when necessary.
- Monitor accounts for suspicious activity. Check for unfamiliar logins, unauthorized changes, and unexpected access to sensitive information.
- Maintain secure backups. Keep regular backups that malware cannot easily modify or delete.
Organizations should also investigate potentially compromised systems, review access logs, and assess whether sensitive information was stolen before declaring an incident resolved.
Conclusion
The disruption of the Amadey malware operation demonstrates how coordinated cyber operations can interfere with criminal infrastructure and limit attackers’ access to compromised computers.
However, disconnecting a malware controller does not automatically remove infections or reverse previous data theft. Users and businesses should continue to prioritize software updates, secure authentication, endpoint protection, and incident response to reduce the risk of further compromise.
