The Australian Signals Directorate (ASD) has successfully infiltrated the backend of a criminal Amadey malware operation, severing its ability to communicate with approximately 180,000 compromised systems worldwide—including targets in Australia. The disruption dismantled their command-and-control (C2) access, cutting off channels used for data theft and further infection. The operation was disclosed in ASD’s annual cyber threat report released on October 27, 2026.
What Is Amadey & How It Works
Amadey is a modular Windows malware-as-a-service (MaaS) platform first seen around 2018. Operators can purchase access to control panels, allowing them to manage botnets, steal credentials, and install additional malicious payloads like stealers, remote access trojans, and spyware. Infection vectors include fake software updates, cracked software installers, “loader” malware, phishing, and malvertising.
ASD’s Offensive Cyber Operation
ASD’s action involved gaining access to the malicious infrastructure behind a specific Amadey operation and disconnecting it from its network of infected computers. This action effectively neutralizes the malware’s ability to issue further commands to those machines. While the infrastructure was disrupted globally, some of the infected were located within Australia.
Despite cutting off active control, the disruption doesn’t erase past damage: credentials or session cookies already stolen can linger in criminal hands for months and facilitate later attacks—including bypassing multi-factor authentication.
Past Disruptions & Related Operations
This is not ASD’s first move against Amadey. Earlier, Operation Endgame—a coordinated international law enforcement initiative—had disrupted servers linked to Amadey, StealC, and SocGholish malware in mid-June. While ASD was not listed among the officially announced participants, the June action similarly targeted critical nodes in the malware supply chain.
ASD also reported another separate success: upon learning of 5 terabytes of stolen data from a business unaware of its breach, the agency intervened and destroyed that data before it could be sold. Approximately 4.8 million files stolen from Australian entities, and hundreds of thousands more from overseas victims, were destroyed in that effort.
Why This Matters
Amadey remains a persistent threat due to its modular architecture and widespread use. Formerly, the malware had been used as a tool to deploy secondary threats like StealC, which specialize in credential theft and sensitive data exfiltration—making even initial Amadey infections potentially high risk.
The ASD’s offensive actions showcase growing capabilities among national agencies to act proactively against cybercrime. High volume infections, legacy systems, and underground criminal marketplaces enable threats like Amadey, so efforts to disrupt infrastructure and prevent further spread are increasingly critical.
Businesses and individuals are urged to avoid pirated software—ASD identified an illegitimate Photoshop copy as a vector for Amadey distribution. Additionally, passwords and session tokens from systems potentially exposed should be changed; legacy systems should be modernized.
This event represents a sharpening in cyber defense strategy: rather than just responding to breaches, agencies are now penetrating and disabling malware infrastructure itself. The question now is whether this approach can scale globally—and how criminal networks will adapt. Ongoing year‐end and early 2027 threat reports should reveal whether such disruptions become the norm or remain exceptional.
