ASD Disconnects Amadey Controller From About 180,000 Infected Computers
Australia's Signals Directorate says it disconnected an Amadey malware controller from about 180,000 infected computers, including some in Australia, reported Oct. 27, 2026.
Australia's Signals Directorate (ASD) said on Oct. 27, 2026 that it had gained access to the backend of an Amadey malware operation and cut a criminal's control over about 180,000 infected computers worldwide, including some in Australia. The agency's acting deputy director-general of intelligence, Tauri Gregory, described the action in an interview with ABC News published the same day.
Amadey is a malware loader sold to criminals as a service. The action disconnected one controller from its victims, so the operator can no longer reach those machines or take data from them, according to The Hacker News.
What ASD Says It Did
Gregory told ABC News that the next step was to "disconnect that Amadey controller from all those victims." He said that without the action, the stolen data of the 180,000 victims would likely have been sold, monetised or used for fraud and identity theft, according to ABC's account.
ABC reports that ASD found the network had access to the 180,000 computers, including some in Australia. The Australian share is not given.
The date of the disconnection is not stated. The reports do not say how ASD gained access to the backend, and they do not identify the operator or where it is based.
What It Means for Businesses With Infected Machines
Citing ESET's analysis, The Hacker News says Amadey mainly installs other malware, such as the StealC infostealer, and can also steal credentials and grant remote access. Common infection routes included fake software updates, cracked software installers and other malware loaders.
Microsoft's analysis, also cited by The Hacker News, says stolen credentials can sit unused for months and that stolen session cookies can bypass multi-factor authentication. And so, effectively, that cyber criminal can no longer access those 180,000 computers and no longer steal data from all those people.
The October reports do not describe victim notification, arrests or clean-up of infected machines.
How Amadey Fits the Cybercrime Economy
ESET says Amadey has been sold as a service since 2018, and each buyer runs its own control panel on its own servers. ESET has identified 53 separate clusters that did not share infrastructure. The largest accounted for nearly 34% of the samples it processed and was the only one active across the whole analysed period.
Reported prices differ. ESET's post lists an advertised licence at US$600 plus US$50 per rebuild, paid in Bitcoin. ABC reports that ASD found evidence of the malware being sold on the dark web for about US$500.
ESET says the affiliate model makes disruption harder, which is why its clustering approach mattered. Its post also says the largest cluster likely ran its own pay-per-install model, monetising its bots further.
“And so, effectively, that cyber criminal can no longer access those 180,000 computers and no longer steal data from all those people.”
Earlier Operation Endgame Action and What Is Still Open
The October reports do not link ASD's action to the June Operation Endgame effort against Amadey and StealC. The Hacker News says Australia was not on Europol's list of countries in the June action week. The Hacker News reports that the June phase ran June 15 to 19.
The June accounts differ on scale. ESET's June 24 post describes about 50 domains and nearly 200 active IP-based command-and-control servers for Amadey and StealC combined. The Hacker News's June report puts the total at 326 servers and 142 domains, and says as many as 27 million stolen credentials were recovered.
ESET says it will keep monitoring both families and track any attempts to rebuild infrastructure. ASD's annual cyber threat report, also published Oct. 27, does not describe this operation, according to The Hacker News.
