# Australian Signals Directorate Disables Global Amadey Malware Network In a decisive move against cybercrime, the **Australian Signals Directorate (ASD)** has announced the successful disruption of a major **Amadey malware** operation. ASD operators gained access to the criminal's backend infrastructure, effectively cutting off 180,000 infected computers globally, including some within Australia, from their illicit command and control. "The next steps that we took were to disconnect that Amadey controller from all those victims," **Tauri Gregory**, ASD's acting deputy director-general of intelligence, told ABC News in an interview published on October 27. ## ASD's Offensive Cyber Capabilities The **ASD** is Australia's primary foreign signals intelligence and cybersecurity agency. Its offensive cyber operations, which require explicit government approval, are designed to disrupt cybercriminals internationally by neutralizing their infrastructure. This incident highlights the agency's capability to execute such high-impact interventions. ## Understanding Amadey Malware **Amadey** is a sophisticated malware-as-a-service (MaaS) offering that has been available to criminals since 2018. According to **ESET**'s analysis, buyers operate their own control panels on independent servers. Once a computer is infected, **Amadey** establishes a connection with its buyer's command-and-control (C2) server, awaiting instructions. Its primary function is to serve as a dropper for additional malware, such as the **StealC infostealer**. Beyond this, **Amadey** can steal credentials and provide remote access to compromised machines. Common infection vectors for **Amadey** include fake software updates, pirated software installers, and other malware loaders. **ESET** has identified 53 distinct **Amadey** botnets, each operating with separate infrastructure, underscoring the fragmented nature of its deployment. ## Limitations and Broader Context While the disconnection prevents future theft, it's crucial to note that it does not reverse any data or credentials already stolen. As **Microsoft**'s analysis points out, stolen credentials can remain dormant for months before being exploited by attackers. Furthermore, compromised session cookies can enable attackers to bypass multi-factor authentication (MFA). Details of this specific operation were not included in the **ASD**'s annual cyber threat report, published on the same day, October 27. ## International Collaboration and Prior Disruptions This disruption follows a broader international effort, **Operation Endgame**, which targeted **Amadey** infrastructure in June. This collaborative law enforcement operation, involving private partners, also focused on **StealC** and **SocGholish malware**. **Europol**'s June announcement listed Australia as one of nine countries whose law enforcement and judicial authorities jointly run **Operation Endgame**, though **ASD** was not specifically mentioned in connection with the June action week. ## A Separate Data Destruction Success In a related but separate incident, the **ASD** revealed it received intelligence about 5 terabytes of stolen business data being offered for sale. The affected business was unaware of the breach. The data encompassed business documents, personal information, and login credentials. Acting swiftly, the agency infiltrated the criminal network and successfully destroyed the data before it could be sold. This preemptive action saved an estimated 4.8 million Australians and hundreds of thousands of international victims from further harm.