A criminal using the Amadey malware can no longer access or steal data from 180,000 infected computers around the world, including some in Australia, the Australian Signals Directorate (ASD) says. The agency’s operators gained access to the criminal’s operation’s backend and cut it off from those computers.
“The next steps that we took were to disconnect that Amadey controller from all those victims,” Tauri Gregory, ASD’s acting deputy director-general of intelligence, told ABC News in an interview published on October 27.
ASD is Australia’s foreign signals intelligence and cyber security agency. Its offensive cyber operations need explicit approval from the Australian government and can disrupt cybercriminals overseas by disabling their infrastructure.
Amadey was sold to criminals as a service in 2018, according to ESET’s analysis of Amadey. Each buyer runs its own control panel on its own servers.
Computers infected with Amadey check in with their buyer’s command-and-control (C2) server and carry out its orders. Amadey’s main job is to install more malware, such as the StealC infostealer. It can also steal credentials and give the buyer remote access to the machine.
The most common ways Amadey reached computers were fake software updates, cracked software installers, and other malware loaders.
The criminal’s Amadey operation was one of many. In its tracking, ESET identified 53 separate Amadey botnets that did not share infrastructure.
Disconnecting a controller from its victims also does not undo earlier theft. Credentials stolen by infostealers can sit unused for months before attackers use them, according to Microsoft’s analysis. A stolen session cookie can allow an attacker to bypass multi-factor authentication (MFA).
ASD’s annual cyber threat report, published on October 27, does not describe the operation.
Amadey’s infrastructure was also disrupted in June by Operation Endgame, an international law enforcement operation that works with private partners. Between June 15 and 19, the operation targeted servers associated with Amadey, StealC, and the SocGholish malware.
Australia is one of nine countries whose law enforcement and judicial authorities run Operation Endgame together, according to Europol’s June announcement. It was not on Europol’s list of countries that took part in the June action week, and the announcement does not mention ASD.
In a separate case, ASD said it received a tip that 5 terabytes of data stolen from a business were for sale. The business did not know it had been hacked. The data included business documents, personal data, and login credentials and passwords.
The agency broke in and destroyed the data before it could be sold. The destroyed files included an estimated 4.8 million stolen from Australians and hundreds of thousands taken from victims in other countries.
