ASD cuts an Amadey operator off from 180,000 infected computers
Original title: Australia Gets Into Amadey Malware Backend, Cuts Off Access to 180,000 Infected Computers
The disruption does not recover credentials already stolen, and ASD’s annual report does not describe the operation.
The Australian Signals Directorate says it accessed one criminal’s Amadey backend and disconnected that controller from 180,000 infected computers worldwide, including some in Australia. Amadey, sold as a service since 2018, installs further malware such as StealC, steals credentials, and can provide remote access, often through fake updates, cracked installers, or loaders. ESET has tracked 53 separate Amadey botnets. Separately, ASD said it destroyed 5 terabytes of stolen business data offered for sale, including an estimated 4.8 million files from Australians.
Unconfirmed: The annual cyber threat report does not describe this operation, and the article does not tie it to the June Endgame action.
- Tauri Gregory described the disconnection in an ABC News interview published October 27.
- Operation Endgame targeted Amadey, StealC, and SocGholish servers from June 15 to 19.
- Australia helps run Operation Endgame but was not listed for that June action week.
- A stolen session cookie can let an attacker bypass multi-factor authentication.
- The destroyed cache also held hundreds of thousands of files from victims outside Australia.
Impact: Credential theft, further malware installation, and remote access on infected computers
- 1.Treat previously stolen credentials and session cookies as still usable even after the controller was cut off.
- Vendors
- Microsoft
- Malware
- AmadeyStealCSocGholish
- Organizations
- Australian Signals DirectorateESETEuropol
- Countries
- Australia
From the original article
2 min read at thehackernews.com
A criminal using the Amadey malware can no longer access or steal data from 180,000 infected computers around the world, including some in Australia, the Australian Signals Directorate (ASD) says. The agency's operators gained access to the criminal's operation's backend and cut it off from those computers. "The next steps that we took were to disconnect that Amadey controller from all those
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.