Skip to content
NewA calmer, faster ZeroHour
StoryMalwarehigh

Australia cuts Amadey controller from 180,000 infected computers

3 sources · 3 articlesFirst reported Updated ()1
What's new

October 29: DataBreaches reports ASD severed Amadey control without touching infected machines, names Gregory acting deputy director-general, and notes such operations need explicit government approval.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

ASD says it severed one Amadey controller from about 180,000 computers and destroyed millions of stolen files offered for sale.

The Australian Signals Directorate says it accessed one criminal’s Amadey backend and disconnected that controller from about 180,000 infected computers worldwide, including some in Australia, without touching the machines. Amadey, sold as a service since 2018, can install further malware such as StealC, steal credentials, and provide remote access. ASD also said it destroyed 5 terabytes of stolen business data offered for sale, including an estimated 4.8 million files from Australians and hundreds of thousands of files from victims elsewhere. The Hacker News reports the annual cyber threat report does not describe the Amadey operation; Security Affairs says that October 27 report covers the 180,000-computer network. Tauri Gregory described the disconnection to ABC; the disruption does not recover credentials already stolen.

Key facts
  • About 180,000 computers were cut off from one Amadey controller.
  • ASD destroyed 5 TB of data, including about 4.8 million Australian files.
  • Amadey has been sold as a service since 2018; ESET has tracked 53 botnets.
  • Offensive cyber operations require explicit Australian government approval.
  • Stolen credentials and session cookies are not recovered by the disconnection.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

Timeline

dated events in the reporting · oldest first
  1. Oct 27, 2026ABC publishes Gregory interview on Amadey disconnection. · The Hacker News
  2. Oct 27, 2026ASD releases its annual cyber threat report. · Security Affairs

What each outlet adds

beyond the shared facts
  • The Hacker NewsSays the annual report omits the Amadey operation; cites ESET and Endgame.
  • Security AffairsSays the October 27 report covers the 180,000-computer Amadey network.
  • DataBreaches.netOperators did not touch victim machines; approval was required.
Vendors
MicrosoftAnthropicOpenAI
Malware
AmadeyStealCSocGholish
Organizations
Australian Signals DirectorateESETEuropolFive Eyes
Countries
AustraliaFranceChinaRussiaNorth Korea
AI models
Mythos

Coverage

oldest first · one row per article · UTC
  1. · 3d ago The Hacker NewsFirst report

    ASD cuts an Amadey operator off from 180,000 infected computers

    The disruption does not recover credentials already stolen, and ASD’s annual report does not describe the operation.

  2. · 3d ago Security Affairs

    ASD chief warns AI will drive more disruptive cyberattacks

    The annual report also covers an Amadey network of 180,000 computers and ASD wiping about 4.8 million stolen files.

  3. · 1d ago DataBreaches.net

    Australia severs Amadey control of about 180,000 infected computers

    ASD operators accessed the Amadey backend and cut controller links without touching the infected machines.