"The next steps that we took were to disconnect that Amadey controller from all those victims," Tauri Gregory, ASD's acting deputy director-general of intelligence, told ABC News on October 27.
ASD's offensive cyber move: cutting access to 180,000 infected machines
The Australian Signals Directorate (ASD) says its operators gained access to a criminal Amadey operation’s backend and severed the connection between the attacker's controller and roughly 180,000 infected computers worldwide, including some in Australia. ASD described the action as a targeted disruption: its operators “disconnected that Amadey controller from all those victims,” according to Tauri Gregory.
ASD is identified in the source as Australia's foreign signals intelligence and cyber security agency. The agency’s offensive cyber activities require explicit approval from the Australian government and can, by design, disrupt cybercriminal infrastructure overseas by disabling control servers.
How Amadey works and why cutting controllers matters — but is not a cure
Amadey is a commodity malware sold to criminals as a service beginning in 2018, according to ESET's analysis mentioned in the source. Each buyer operates a separate control panel on its own servers; infected computers check in with their buyer's command-and-control (C2) server and carry out that buyer’s orders. Amadey’s principal functions are to install additional malware — notably the StealC infostealer — to steal credentials and to provide remote access to the machine.
Disconnecting a controller prevents the operator of that specific C2 panel from issuing new commands, but it does not reverse earlier theft. The source cites Microsoft analysis observing that credentials harvested by infostealers can sit unused for months before attackers deploy them, and that a stolen session cookie can allow an attacker to bypass multi-factor authentication.
The cyber insurance questionnaire just landed. Now what?
SOC 2, HIPAA, insurance renewals - someone has to own security strategy. Nubivance provides fractional CISO leadership without the full-time salary.
Get a security leadESET tracking and the wider disruption of Amadey infrastructure
Amadey is not a single centralized botnet. ESET’s tracking identified 53 separate Amadey botnets that did not share infrastructure, underscoring the modular, customer-driven nature of the malware-as-a-service market. The most common delivery vectors for Amadey infections were fake software updates, cracked software installers and other malware loaders, the source reports.
The infrastructure was already targeted earlier in 2026: Operation Endgame, an international law enforcement action coordinated with private partners, disrupted servers linked to Amadey, StealC and SocGholish between June 15 and 19. Europol’s June announcement lists nine countries whose law enforcement and judicial authorities run Operation Endgame together; however, ASD was not on Europol’s list of countries that took part in the June action week and the announcement does not mention ASD.
Data-tip response: 5 terabytes seized and destroyed
Separately from the controller-disconnect, ASD reported receiving a tip that 5 terabytes of stolen data from a business were being offered for sale. The business whose data was in the cache did not know it had been hacked. The files reportedly contained business documents, personal data and login credentials and passwords.
ASD said it broke into the repository and destroyed the data before it could be sold. The agency estimates that the destroyed files included about 4.8 million records from Australians and hundreds of thousands of records from victims in other countries.
ASD’s annual cyber threat report, published on October 27, does not describe this controller-disconnect operation.
What this means for technologists, policymakers, and affected enterprises
- Technologists and security teams should note that removing a live C2 connection halts active control but does not erase prior data exfiltration; Microsoft’s analysis quoted in the source warns that stolen credentials and session cookies can be abused long after initial theft.
- Policymakers and legal authorities have an operational precedent: ASD carried out an intrusive disruption that required explicit government approval; the agency also acted on a commercial-market tip to destroy stolen data, demonstrating a dual role in disruption and incident response.
- Affected enterprises need to recognize that organizations may be unaware of breaches until data appears for sale. The case ASD described involved a business that did not know it had been hacked and whose stolen materials amounted to terabytes, including millions of Australian records.
ASD’s actions removed a live access path used by one Amadey operator and destroyed a large cache of stolen material — decisive steps that address immediate access and resale risk. The record in the source is also clear about limits: many Amadey operations exist independently, and prior theft can remain usable well after a controller is disconnected. The practical test ahead, left implicit in these facts, is straightforward and consequential: will credentials and session artifacts stolen before these disruptions surface in downstream fraud or account takeover campaigns — and who will detect them?
