Australia Gets Into Amadey Malware Backend, Cuts Off Access to 180,000 Infected Computers
A criminal using the Amadey malware can no longer access or steal data from 180,000 infected computers around the world, including some in Australia, the Australian Signals Directorate (ASD) says.
A criminal using the Amadey malware can no longer access or steal data from 180,000 infected computers around the world, including some in Australia, the Australian Signals Directorate (ASD) says.
The agency's operators gained access to the criminal's operation's backend and cut it off from those computers; tauri Gregory, ASD's acting deputy director-general of intelligence, told ABC News in an interview published on October 27.
In its tracking, ESET identified 53 separate Amadey botnets that did not share infrastructure, and aSD's annual cyber threat report , published on October 27, does not describe the operation.
Its offensive cyber operations need explicit approval from the Australian government and can disrupt cybercriminals overseas by disabling their infrastructure.
Each buyer runs its own control panel on its own servers.
Amadey's main job is to install more malware, such as the StealC infostealer, and it can also steal credentials and give the buyer remote access to the machine.
Computers infected with Amadey check in with their buyer's command-and-control (C2) server and carry out its orders; the most common ways Amadey reached computers were fake software updates, cracked software installers, and other malware loaders.
What happened
A criminal using the Amadey malware can no longer access or steal data from 180,000 infected computers around the world, including some in Australia, the Australian Signals Directorate (ASD) says.
The agency's operators gained access to the criminal's operation's backend and cut it off from those computers; tauri Gregory, ASD's acting deputy director-general of intelligence, told ABC News in an interview published on October 27.
What changed
In its tracking, ESET identified 53 separate Amadey botnets that did not share infrastructure, and aSD's annual cyber threat report , published on October 27, does not describe the operation.
Who is affected
Its offensive cyber operations need explicit approval from the Australian government and can disrupt cybercriminals overseas by disabling their infrastructure.
Each buyer runs its own control panel on its own servers.
Why it matters
Amadey's main job is to install more malware, such as the StealC infostealer, and it can also steal credentials and give the buyer remote access to the machine.
Technical details
Computers infected with Amadey check in with their buyer's command-and-control (C2) server and carry out its orders; the most common ways Amadey reached computers were fake software updates, cracked software installers, and other malware loaders.
Attribution
The Hacker News: A criminal using the Amadey malware can no longer access or steal data from 180,000 infected computers around the world, including some in Australia, the Australian Signals Directorate (ASD) says.
What to watch next
Watch for revised vendor guidance, fixed versions and mitigation updates.