Australia's ASD cuts off Amadey botnet from 180,000 infected computers

The Australian Signals Directorate (ASD), the country's signals intelligence and cyber security agency, says it broke into the backend of a criminal Amadey malware operation and cut off its access to about 180,000 infected computers around the world, according to The Hacker News. The disclosure, made on October 27, 2026, is a rare public account of an offensive cyber operation against a cybercrime botnet.

What happened

According to The Hacker News, ASD operators gained access to the backend of one criminal's Amadey operation and disconnected the controller from the machines it had infected. 'The next steps that we took were to disconnect that Amadey controller from all those victims,' ASD's acting deputy director-general of intelligence, Tauri Gregory, was quoted as saying. As a result, about 180,000 infected computers, including some in Australia, could no longer be accessed or used to steal data.

The report notes that ASD's offensive cyber operations require explicit approval from the Australian government and that the agency can disrupt overseas cybercriminals by disabling their infrastructure. The operation is not described in ASD's annual cyber threat report, which was also published on October 27.

What is Amadey

Citing ESET's analysis, The Hacker News reported that Amadey has been sold to criminals as a service since 2018. Each buyer runs its own control panel on its own servers, and infected computers check in with that server to receive orders. Its main job is installing further malware, such as the StealC infostealer, but it can also steal credentials and give the buyer remote access. Common infection routes include fake software updates, cracked software installers and other malware loaders. ESET has identified 53 separate Amadey botnets that do not share infrastructure, meaning the operation ASD disrupted was only one of many.

Amadey infrastructure was also targeted in June during Operation Endgame, an international law enforcement effort with private partners that hit servers linked to Amadey, StealC and SocGholish.

A second ASD case

The Hacker News also reported that ASD acted on a tip that 5 terabytes of data stolen from a business, which did not know it had been hacked, were for sale. ASD broke in and destroyed the data before it could be sold; the files included an estimated 4.8 million records taken from Australians and hundreds of thousands from victims elsewhere.

What to do

Disconnecting a controller does not undo earlier theft. As the report points out, stolen credentials can sit unused for months, and stolen session cookies can allow attackers to bypass multi-factor authentication. Organizations that detect Amadey or StealC infections should clean the affected machines, reset passwords and revoke active sessions for any accounts used on them.