Australian Intelligence Breaks Into Amadey Backend, Cuts Off 180,000 Infected Computers

A criminal using the Amadey malware can no longer control or steal data from 180,000 infected computers around the world, some of them in Australia. The Australian Signals Directorate (ASD) says its operators got into the backend of the criminal operation and cut it off from its victims.

"The next steps that we took were to disconnect that Amadey controller from all those victims," Tauri Gregory, ASD's acting deputy director-general of intelligence, told ABC News in an interview published on October 27.

ASD is Australia's foreign signals intelligence and cyber security agency. Its offensive cyber operations require explicit approval from the Australian government and can disrupt cybercriminals overseas by disabling their infrastructure.

What Amadey is

According to ESET, Amadey has been sold to criminals as a service since 2018. Each buyer runs its own control panel on its own servers. Infected computers check in with the buyer's command-and-control (C2) server and carry out its orders.

Amadey's main job is to install additional malware, such as the StealC infostealer. It can also steal credentials and give the buyer remote access to the machine. It most commonly reached computers through fake software updates, cracked software installers and other malware loaders.

The disrupted operation was only one of many: ESET identified 53 separate Amadey botnets that did not share infrastructure.

The limits

Disconnecting a controller does not undo earlier theft. As Microsoft notes, credentials stolen by infostealers can sit unused for months before attackers put them to work, and a stolen session cookie can let an attacker bypass multi-factor authentication.

ASD's annual cyber threat report, published on October 27, does not describe the operation.

Amadey's infrastructure had already taken a hit in June, when Operation Endgame, an international law enforcement effort run with private partners, targeted servers tied to Amadey, StealC and SocGholish between June 15 and 19. According to Europol, Australia is one of nine countries whose law enforcement and judicial authorities run Operation Endgame. However, it was not listed among participants in the June action week, and the announcement does not mention ASD.

5 TB destroyed

In a separate case, ASD received a tip that 5 TB of data stolen from a business was up for sale. The business did not know it had been breached. The data included business documents, personal information, login credentials and passwords. The agency broke in and destroyed the data before it could be sold. By ASD's estimate, the destroyed material included around 4.8 million items stolen from Australians and hundreds of thousands taken from victims in other countries.

Source: The Hacker News