Some good news for a change. The Australian Signals Directorate got into the backend of a criminal’s Amadey malware operation and disconnected its controller from about 180,000 infected computers worldwide. “The next steps that we took were to disconnect that Amadey controller from all those victims,” ASD’s Tauri Gregory told ABC News.
What Amadey does
Amadey has been sold as a service since 2018. Its main job is loading more malware, like the StealC infostealer, plus stealing credentials and giving remote access. It mostly spreads through fake updates and cracked installers. ESET counts 53 separate Amadey botnets, so this was one of many.
ASD also said it broke into a seller’s stash and destroyed 5 TB of stolen business data, including an estimated 4.8 million files from Australians, before it could be sold.
My take
Love it. But cutting the cord doesn’t un-steal anything. Infostealer creds and session cookies can sit for months and still get you past MFA. If a machine ever ran a cracked installer, assume its saved passwords and sessions are burned: rotate passwords, sign out all sessions, and reimage.
God Bless, and Happy hacking!
