Australia's Signals Directorate seizes Amadey backend and severs 180,000 bots

Australian spies inside a criminal control panel

The Australian Signals Directorate (ASD) gained access to the backend of a criminal Amadey operation and disconnected its command-and-control server from roughly 180,000 infected computers worldwide, including machines in Australia. Tauri Gregory, ASD's acting deputy director-general of intelligence, described the operation in an ABC News interview published on October 27, as reported by The Hacker News.

This was not a court-ordered domain seizure. ASD is Australia's foreign signals intelligence and cyber security agency, and its offensive operations require explicit government approval. Here, the agency entered the attacker's own control system and used it to release the victims.

How Amadey spreads and what it does

Amadey has been marketed to criminals on a service model since 2018, according to ESET's analysis. Each customer runs its own control panel on its own servers, and infected machines check in for instructions. Amadey's core job is loading additional malware, such as the StealC infostealer, alongside credential theft and remote access.

Infection generally happens through fake software updates, cracked installers and other loaders. Those are user-driven paths rather than software exploits, so there is no vendor patch that closes them; defence depends on user behaviour and device controls.

One botnet out of 53

The same service model limits the reach of the takedown. ESET has identified 53 separate Amadey botnets that do not share infrastructure. ASD disrupted one of them; the other operators kept running.

Amadey infrastructure had also been hit earlier in the year. Between June 15 and 19, Operation Endgame, an international law enforcement effort working with private partners, targeted servers associated with Amadey, StealC and SocGholish. Europol's June announcement lists Australia among the nine countries running Operation Endgame, but Australia does not appear among the countries that took part in the June action week, and the announcement does not mention ASD. Based on public sources, the ASD action appears to be a separate effort, and the details surfaced through an interview rather than a formal disclosure — the agency's annual cyber threat report, also published on October 27, does not describe it.

Taking the controller offline does not undo the theft

Cutting a controller off from its victims does not reverse what was already taken. Microsoft's research on infostealers indicates that stolen credentials can sit unused for months before attackers deploy them, and that a stolen session cookie can be used to bypass multi-factor authentication. The 180,000 machines no longer report to this operator, but anything already exfiltrated from them may still be for sale.

A separate case: 5 terabytes of stolen data

ASD's report also describes another operation. The agency received a tip that 5 terabytes of data stolen from a business were up for sale — a business that did not know it had been hacked. The trove included business documents, personal information and login credentials. ASD breached the criminal infrastructure and destroyed the data before it could be sold. The agency estimates the files held 4.8 million items taken from Australians — the report does not specify the unit being counted — plus hundreds of thousands more from victims in other countries.

In both cases, the intervention played out on the attackers' infrastructure, not inside the victims' networks, and the victims took no part. A business can benefit from an operation like this without ever learning it happened — which also means it cannot count on one happening.

Why it matters

The story shows intelligence agencies applying offensive capability directly against cybercriminal infrastructure, with concrete results: one operator lost control of 180,000 machines, and 5 terabytes of stolen data never reached a buyer. It also shows the limits of that approach. Amadey is a product with dozens of independent deployments, and the credentials and cookies it harvested outlive the servers used to steal them. For organisations whose users may have installed a malicious update or cracked installer, the takedown should be read as the start of an exposure review, not the end of one: treat credentials and session tokens from any infostealer-affected machine as compromised, shorten and revoke sessions aggressively, watch unmanaged devices that reach corporate apps, plan for the possibility of learning about a breach from a government agency rather than an internal alert, and keep monitoring for credential misuse over months, not days.