Security Operations

Australia’s ASD cuts Amadey controller off from 180,000 PCs

ASD broke into an Amadey malware operation, cut 180,000 infected PCs loose and destroyed 5TB of stolen data. What UK defenders should do next.

Network graphic with headline: ASD cuts off 180,000 Amadey-infected PCs

Australia’s signals intelligence agency says it got inside a criminal’s Amadey malware operation and cut the controller off from roughly 180,000 infected computers around the world. The disruption is welcome, but anything already stolen from those machines is still out there, and UK defenders should treat the news as a prompt to hunt rather than relax.

What happened

On 27 October 2026 the Australian Signals Directorate (ASD) disclosed details of two offensive cyber operations it had previously kept quiet. The disclosures came in an exclusive interview with ABC News, published on the same day as ASD’s Annual Cyber Threat Report 2025-26.

In the first operation, ASD operators reached the back end of a criminal’s Amadey operation and found it had access to around 180,000 computers worldwide, some of them in Australia. According to Tauri Gregory, ASD’s acting deputy director-general of intelligence, the agency then disconnected the Amadey controller from every one of those victims, so the operator could no longer reach the machines or keep harvesting data from them. ASD said it had found Amadey hidden in a pirated copy of Photoshop, and saw it sold on the dark web for about US$500.

In the second case, ASD was tipped off that a 5TB haul taken from an unsuspecting business was up for sale. Gregory said the agency broke in and destroyed the cache before any sale went through. He estimated it held about 4.8 million files taken from Australians, plus hundreds of thousands of files belonging to victims in other countries.

The Hacker News noted that ASD’s offensive operations require explicit approval from the Australian government.

The technical picture

Amadey is not a new or exotic piece of malware. ESET’s research, cited by The Hacker News, says it has been sold as a service since 2018, with each buyer running a separate control panel on their own servers. An infected PC checks in with its buyer’s command-and-control (C2) server and does what it is told. Usually that means downloading further malware, such as the StealC infostealer. Amadey can also steal credentials itself and give its operator remote access.

The usual infection routes are fake software updates, cracked installers and other malware loaders, which fits ASD’s Photoshop example. Because every customer runs their own infrastructure, there is no single Amadey botnet to take down. ESET has tracked 53 separate Amadey botnets with no shared infrastructure, so ASD’s operation removed one large operator rather than the whole ecosystem.

Amadey has been hit before. Between 15 and 19 June 2026, Operation Endgame, the multinational law enforcement effort coordinated through Europol, went after servers linked to Amadey, StealC and SocGholish. Australia is one of the nine countries behind Endgame, but The Hacker News points out that it was not listed among the participants in that June action week, and Europol’s announcement does not mention ASD.

The key detail for defenders is what disconnection does not achieve. Microsoft’s analysis, also referenced by The Hacker News, notes that infostealer-harvested credentials may lie dormant for months before being abused. A stolen session cookie can let an attacker skip multi-factor authentication (MFA) altogether. Cutting off the C2 stops new theft from those 180,000 machines. It does nothing about passwords, tokens and browser sessions that have already been exfiltrated and sold on.

Flow diagram showing Amadey infection stages from lure to ASD disruption and the lingering risk of stolen credentials

Why it matters for UK organisations

ASD has not published a country breakdown of the 180,000 victims, so it is impossible to say how many are in Britain. But Amadey operations are global, and loader-plus-infostealer infections are a well-known precursor to ransomware and business email compromise. If staff use personal devices or reuse passwords between home and work, assume some corporate credentials have passed through infostealer logs.

The wider threat report, as summarised by Australian Cyber Security Magazine and Cyber Daily, tells a story that UK security teams will recognise. Over the year, more than 82,000 cybercrime reports reached the Australian Cyber Security Centre, about one every six minutes. It responded to more than 1,500 incidents, up over 20%, and sent more than 4,400 notifications to organisations about possible malicious activity, an increase of almost 80%. ASD director-general Abigail Bradshaw told ABC News that “with each capability increase, we are likely to see more disruption” as AI advances. Yet the report still finds unpatched systems, social engineering and compromised credentials among the persistent weaknesses behind successful attacks.

A government taking an infostealer pipeline offline is helpful, but it is not a control you can rely on or audit.

Expert view

This is offensive cyber capability pointed at criminal infrastructure, and I would like to see more of it. Disconnecting 180,000 victims in one go achieves more than any amount of awareness training could in the short term.

From a defender’s chair, though, I would read the story the other way round. In my experience, when we review incidents that started with valid credentials, the trail very often leads back to an infostealer on a machine nobody was watching: a contractor’s laptop, a home PC used for webmail, a developer’s personal device with a synced browser profile. The theft happened months earlier, and the intrusion only looked like a login from an unusual location.

Amadey’s model also explains why takedowns fall short: with every buyer running their own C2, each disruption buys time but repairs nothing already stolen.

The data destruction case is just as interesting. A business had 5TB taken without noticing, which tells you its detection and egress monitoring were not working. You should not count on an agency deleting it for you.

What to do now

  1. Hunt for loader and infostealer activity. Check EDR telemetry for unknown executables that persist after running from user-writable folders, and for unexpected outbound connections to newly seen hosts. Prioritise endpoints with a history of pirated or unapproved software (Cyber Essentials: malware protection).
  2. Assume session theft, not just password theft. For accounts linked to any suspected infection, revoke active sessions and refresh tokens as well as resetting passwords. Where your identity platform supports it, use token protection or device-bound sessions so a stolen cookie cannot be replayed from elsewhere.
  3. Move to phishing-resistant MFA for administrators and remote access first. Combined with device-compliance conditional access it narrows the gap (Cyber Essentials: user access control).
  4. Close the cracked-software route. Enforce application allow-listing on corporate devices and stop users installing software themselves. Fake updates and pirated tools are Amadey’s front door (Cyber Essentials: secure configuration).
  5. Watch outbound volumes. A business losing 5TB without noticing is an egress monitoring failure. Alert on unusual data transfers to cloud storage and unfamiliar destinations.
  6. Use the free services. UK organisations can sign up to the NCSC’s Early Warning service, which flags potential compromises seen on your network ranges.

Bottom line

ASD’s operation took one large Amadey operator off 180,000 machines and wiped a stolen data cache before it reached buyers. That is a genuine win. But Amadey runs as dozens of independent botnets, and the credentials and sessions it has already stolen are still in circulation. UK security teams should treat it as a reminder to hunt for infostealers, revoke sessions as well as passwords, and stop relying on someone else’s takedown.

Sources

Related Posts