How Australia Shut Down an Amadey Botnet Controlling 180,000 Infected Machines—And What It Means for Your Cloud Security
Executive Summary
In October 2026, Australia's Signals Directorate (ASD) disclosed that its operators had infiltrated the backend infrastructure of an Amadey Botnet-as-a-Service operation, severing command-and-control access to approximately 180,000 infected computers worldwide. The Amadey malware, sold to cybercriminals since 2018, was used to deploy infostealers such as StealC, harvest credentials, and enable remote access. ASD's offensive cyber unit—acting under explicit government authorization—disconnected the attacker's C2 controller from all victim machines. In a parallel action, the agency also destroyed 5 terabytes of stolen Australian data, including 4.8 million records, before it could be sold on criminal markets.
This incident reflects a global escalation in law enforcement and signals-intelligence agencies conducting active, offensive disruption of cybercriminal infrastructure—moving beyond passive monitoring to preemptive takedowns. It also underscores the persistent danger of previously stolen credentials and session cookies, which can be weaponized months after initial compromise, bypassing MFA controls and extending attacker dwell time indefinitely.
Why This Matters Now
Infostealer-as-a-Service platforms like Amadey have industrialized credential theft at scale, with 53 independent botnets identified in this campaign alone. Stolen session tokens can bypass MFA long after C2 takedowns occur, meaning organizations remain at risk even after law enforcement intervention. Enterprises running multi-cloud workloads must enforce egress controls, east-west segmentation, and anomaly detection now—before harvested credentials are weaponized.
Attack Path Analysis
Amadey malware operators distributed their botnet loader through fake software updates, cracked software installers, and malware loaders, compromising approximately 180,000 endpoints globally. Once installed, Amadey bots checked in with operator-controlled C2 panels, received tasking orders, deployed secondary payloads such as StealC infostealer, harvested credentials and session cookies, and exfiltrated up to 5 terabytes of sensitive data including business documents, personal data, and login credentials before ASD's offensive cyber operation severed the C2 connection and destroyed stolen data staged for sale.
Kill Chain Progression
This analysis maps confirmed threat intelligence to the full cloud kill chain to show where defensive gaps would emerge as an attack progresses.
Initial Compromise
Description
Amadey was distributed to victim endpoints via trojanized cracked software installers, fake software update lures, and secondary malware loaders acting as droppers. Victims executed malicious binaries believing them to be legitimate software, resulting in silent Amadey loader installation on host systems.
MITRE ATT&CK® Techniques
Phishing
Drive-by Compromise
User Execution: Malicious File
Command and Scripting Interpreter
Application Layer Protocol: Web Protocols
Ingress Tool Transfer
Steal Web Session Cookie
Exfiltration Over C2 Channel
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
NIST SP 800-53 Rev 5 – Malicious Code Protection / Software, Firmware, and Information Integrity
Control ID: SI-3 / SI-7
CISA Zero Trust Maturity Model 2.0 – Continuous Identity Validation and Session Trust
Control ID: Identity Pillar – MFA and Session Management
NIS2 Directive – Incident Handling and Supply Chain Security
Control ID: Article 21 – Cybersecurity Risk Management Measures
PCI DSS 4.0 – Protection Against Malicious Software / Authentication and Access Control
Control ID: Requirement 5 / Requirement 8.6
GDPR (Regulation EU 2016/679) – Security of Processing / Notification of Personal Data Breach
Control ID: Article 32 / Article 33
DORA (Digital Operational Resilience Act) – ICT-Related Incident Detection and Response / ICT Third-Party Risk
Control ID: Article 10 / Article 17
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Financial Services
Amadey infostealer botnet targeting credential theft and session cookie hijacking directly exposes financial services firms to MFA bypass, account takeover, and egress-based data exfiltration of sensitive transactional and customer data.
Information Technology/IT
IT organizations face systemic risk from Amadey's Botnet-as-a-Service model deploying StealC via cracked software and fake updates, enabling lateral movement, C2 callbacks, and credential harvesting across managed infrastructure environments.
Health Care / Life Sciences
With 4.8 million personal records stolen and login credentials exposed, healthcare entities face HIPAA compliance violations mapped to NIST.800-53.SC-7 and PCI egress controls due to undetected infostealer persistence on clinical endpoints.
Government Administration
ASD's disruption of 180,000 infected endpoints and destruction of 5TB of stolen government-adjacent data underscores critical exposure of public sector networks to Amadey C2 infrastructure and credential exfiltration without egress policy enforcement.
Sources
- Australia Gets Into Amadey Malware Backend, Cuts Off Access to 180,000 Infected Computershttps://thehackernews.com/2026/10/australia-gets-into-amadey-malware.htmlVerified
- ASD Acting Deputy Director-General Interview on Amadey Disruption - ABC News Australiahttps://www.abc.net.au/news/2026-10-27/australian-signals-directorate-ai-cybersecurity-hacking-threats/107309858Verified
- Australian Signals Directorate - Offensive Cyber Operationshttps://asd.gov.au/about/what-we-do/offensive-cyberVerified
- ESET Takes Part in Operation Endgame - Disrupting Amadey and StealChttps://www.welivesecurity.com/en/eset-research/eset-takes-part-operation-endgame-disrupt-amadey-stealc/Verified
- Microsoft Security Blog - StealC and Amadey: Breaking Down Infostealers and the Cybercrime Services That Deliver Themhttps://www.microsoft.com/en-us/security/blog/2026/06/24/stealc-and-amadey-breaking-down-infostealers-and-the-cybercrime-services-that-deliver-themVerified
- Europol - Global Cyber Strike Disrupts SocGholish, Amadey and StealC Malware Networkshttps://www.europol.europa.eu/media-press/newsroom/news/global-cyber-strike-disrupts-socgholish-amadey-and-stealc-malware-networksVerified
- ASD Annual Cyber Threat Report 2025-26https://www.cyber.gov.au/publication/annual-cyber-threat-report-2025-26Verified
- The Hacker News - Amadey and StealC Malware Network Disrupted (Operation Endgame June 2026)https://thehackernews.com/2026/06/amadey-and-stealc-malware-network.htmlVerified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Based on the attack progression modeled above, these are the defensive controls that would constrain each stage.
Aviatrix Zero Trust CNSF is directly relevant to this incident because Amadey botnet operators relied on uncontrolled outbound connectivity and unrestricted lateral access across victim environments to beacon to C2 infrastructure, deliver secondary payloads, and exfiltrate data at scale. By enforcing workload-level segmentation, identity-aware routing, and controlled egress policies, Aviatrix CNSF would likely have reduced the blast radius available to operators after initial endpoint compromise.
Control: Cloud Native Security Fabric (CNSF)
Mitigation: CNSF fabric-level enforcement would likely constrain the reachability of newly compromised workloads, reducing the scope of outbound connections an infected endpoint could establish immediately after loader execution, limiting the attacker's ability to pull secondary payloads from external staging infrastructure.
Control: Zero Trust Segmentation
Mitigation: Zero Trust segmentation would likely reduce the scope of authenticated access available to an attacker wielding harvested credentials, since identity-scoped access controls could constrain which workloads or services a credential-bearing session is permitted to reach within the environment.
Control: East-West Traffic Security
Mitigation: East-west traffic enforcement would likely limit how freely an attacker using stolen credentials could traverse between workloads or services, reducing the number of reachable targets available for lateral pivot even when authentication itself succeeds.
Control: Multicloud Visibility & Control
Mitigation: Multicloud visibility and centralized control would likely reduce the number of active bot-to-C2 connections that go undetected, and could constrain outbound beaconing paths by surfacing anomalous outbound communication patterns across cloud-hosted workloads before operators receive sustained tasking responses.
Control: Egress Security & Policy Enforcement
Mitigation: Egress security enforcement would likely constrain the volume and destinations of outbound data transfers originating from compromised workloads, reducing the attacker's ability to move large collections of harvested credentials and documents to operator-controlled staging infrastructure without policy intervention.
Where prior CNSF controls successfully constrained east-west movement, egress paths, and C2 reachability, the residual impact on affected organizations would likely be reduced in scope, with fewer workloads exposed to credential reuse attacks and a smaller pool of harvested authentication material available for downstream fraud or account takeover campaigns.
Impact at a Glance
Affected Business Functions
- End-User Credential and Identity Management
- Corporate Authentication Systems and Session Security
- Enterprise Data Loss Prevention and Incident Response
- Consumer and Business Personal Data Protection
Estimated downtime: N/A
Estimated loss: N/A
Approximately 180,000 infected computers globally were compromised by the Amadey botnet, with the malware capable of harvesting credentials, session cookies, and enabling remote access. Stolen session cookies can bypass multi-factor authentication. In a related ASD-disclosed incident, 5 terabytes of stolen data were recovered and destroyed before sale, comprising approximately 4.8 million records belonging to Australians and hundreds of thousands from victims in other countries. Data categories included business documents, personally identifiable information (PII), and plaintext login credentials and passwords. Credentials stolen by infostealers such as StealC can remain dormant for months before being exploited, meaning downstream financial fraud, account takeover, and identity theft risks persist beyond the disruption event.
Recommended Actions
Key Takeaways & Next Steps
- • Deploy Egress Security & Policy Enforcement (FQDN filtering and outbound traffic controls) to detect and block Amadey bot beaconing to known-bad or uncategorized C2 domains before credential exfiltration completes, directly disrupting the Command & Control and Exfiltration stages.
- • Enable Multicloud Visibility & Control with centralized traffic observability and anomaly baselining to identify abnormal outbound data volumes and repeated check-in patterns consistent with botnet C2 beaconing across hybrid and cloud-connected endpoints.
- • Enforce Zero Trust Segmentation using identity-based microsegmentation and least-privilege policies to contain lateral movement driven by stolen credentials and session cookies, preventing compromised endpoint access from pivoting to business-critical systems and data stores.
- • Implement Inline IPS (Suricata) with current threat signatures covering Amadey loader delivery patterns, StealC payload staging, and known malware delivery infrastructure to detect and block malicious payload downloads at network ingress and egress inspection points.
- • Apply East-West Traffic Security controls to monitor and restrict workload-to-workload and service-to-service communication flows, ensuring that credential-reuse-based lateral movement within cloud and on-premises environments is detected and blocked before attackers can reach sensitive data repositories containing business documents and personal data.
