Back www.darkreading.com

Dark Reading: Supercharged Version of Amadey Infostealer and Malware Dropper Bypasses AVs

www.darkreading.com • October 25, 2026

Several threat actors used Amadey Bot previously to steal information and distribute malware such as the GandCrab ransomware and the FlawedAmmy RAT.

A dangerous malware variant called "Amadey Bot" that has been largely dormant for the past two years has surfaced again with new features that make it stealthier, more persistent, and much more dangerous than versions — including antivirus bypasses.

Amadey Bot first appeared in 2018 and is primarily designed to steal data from infected systems. However, various threat actors — such as Russia's infamous TA505 advanced persistent threat (APT) group — have also used it to distribute other malicious payloads, including GandCrab ransomware and the FlawedAmmy remote access Trojan (RAT), making it a threat for enterprise organizations .

Previously, threat actors used the Fallout and RIG exploit kits, as well as the AZORult infostealer, to distribute Amadey. But researchers at South Korea's AhnLab recently spotted the new variant being installed on systems via SmokeLoader , a malware dropper that attackers have been using since at least 2011.

Researchers at AhnLab found that the operators of the new Amadey variant have disguised SmokeLoader in software cracks and fake keys for commercial software that people often use to try and activate pirated software. When users download the malware assuming it is a cracked (pirated) version or a key generator, SmokeLoader injects its malicious payload into the currently running Windows Explorer process (explorer.exe) and then proceeds to download Amadey on the infected system, the researchers at AhnLab discovered.

Once the malware is executed, Amadey lodges itself in the TEMP folder as a startup folder, ensuring the malware will persist even after a system reboot. As an additional persistence measure, Amadey also registers itself as a scheduled task in Task Scheduler, according to AhnLab.

After the malware completes its initial setup processes, it contacts a remote, attacker-controlled command-and-control server (C2) and downloads a plug-in to collect environment information. This includes details such as the computer and username, operating system information, a list of applications on the system, and a list of all anti-malware tools on it.

The sample of the new Amadey variant that researchers at AhnLab analyzed was also designed to take periodic screenshots of the current screen and send them back in a .JPG format to the attacker controlled C2 server.

Bypassing AV Protections

AhnLab found that the malware is configured to look for and bypass antivirus tools from 14 vendors, including Avast, Avira, BitDefender, Kaspersky, Sophos, and Microsoft's Windows Defender.

"The new and improved version of the malware flaunts even more features compared to its predecessor," security vendor Heimdal said in a blog post . This includes features "such as scheduled tasks for persistence, advanced reconnaissance, UAC bypassing, and defense evasion strategies tailored for 14 known antivirus products," it noted.

Once Amadey relays system information to the C2 server, the threat actor knows exactly how to bypass protection for the specific AV tools that might be present on the system. "On top of that, once Amadey gets ahold of your AV’s profile, all future payloads or DLLs will be executed with elevated privileges," Heimdal warned in the blog post.

A More Dangerous Version of Amadey

The information that Amadey relays to the C2 server allows the attackers to take a variety of follow-up actions, including installing additional malware. The sample that AhnLab analyzed, for instance, downloaded a plug-in for stealing Outlook emails and information FTPs and VPN clients on the infected system.

It also installs an additional information stealer called RedLine on the victim system. RedLine is a prolific information stealer that first surfaced in 2020 and has been distributed via various mechanisms , including COVID-19 themed phishing emails, fake Google ads and in targeted campaigns. Researchers from Qualys recently observed the malware being distributed via fake cracked software on Discord.

Researchers from BlackBerry Cylance who analyzed the earlier version of Amadey determined at the time that the malware does not install any additional payloads if it assesses the victim to be in Russia.

Dmitry Bestuzhev, threat researcher at BlackBerry says SmokeLoader has been actively tricking victims via cracked software and so-called “software activation” programs from the beginning of this year.

"We saw several brands being abused by cybercriminals spreading malicious cracks for the most popular software houses," he says.

Amadey's botnet too has been very active, impersonating popular private and secure email vendors to infect targets. "According to our telemetry, most of them are in the US, followed by Japan, Mexico and Brazil," Bestuzhev says.

Illinois-based Jai Vijayan is a veteran, award-winning technology journalist with more than 25 years of experience covering cybersecurity. His information security reporting has explored everything from ransomware, nation-state threats, and identity security to AI risk, critical infrastructure protection, software supply chain security, cloud security and emerging enterprise technologies.

Over the course of his career, Jai has written news stories, feature articles, survey reports, white papers, and e-books for enterprise and technology audiences. He has also moderated panel discussions and executive roundtables featuring CISOs, security researchers, and industry leaders.

Jai previously served as senior editor at Computerworld, where he covered information security and data-privacy issues. His work has also appeared in CSO Online, InformationWeek, The Christian Science Monitor Passcode, The Economic Times, and other publications.

His work has earned multiple industry honors, including a Joint ASBPE Excellence Award for Best Coverage of Government IT, and a Joint Jesse H. Neal Award for wireless LAN security coverage. Jai holds a Master’s degree in statistics from Bangalore University, and studied broadcasting and electronic communication at Marquette University in Milwaukee.

Want more Dark Reading stories in your Google results?

The State of Cloud Security: The Latest Challenges

How Organizations Are Managing Incident Response

How Enterprises Are Developing Secure Applications

Inside RSAC 2026: security leaders reveal the risks redefining your defense strategy

Essential News & Insights from Black Hat USA 2025

Prompt Injection 101: What It Is and How to Stay Ahead

The Long Tail Is Now the Front Line: Reducing Frontier-AI & Third-Party App Risk

How to Harness your Security Operations Data for Enterprise Defense

Building Cyber Resilience: Beyond Prevention to Recovery

The Frontier AI Threat: Closing the Mobile Gap in Your Exposure Management Strategy

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Amadey Malware Distributed via SmokeLoader: Threat Analysis Amadey malware, a Windows trojan bot first identified in 2018, is currently being distributed through SmokeLoader, a malware known for delivering additional malicious payloads. This malware family can steal information and install further malware by executing commands from remote attackers. Recent statistics indicate that SmokeLoader has been prevalent in malware distribution, particularly disguised as software cracks. The AhnLab ASEC team has linked Amadey to various cybercriminal groups, including those behind ransomware attacks. As of October 21, 2026, there have been multiple indicators and samples of Amadey detected in threat intelligence databases. Users are advised to remain vigilant against potential infections, especially from suspicious downloads. The current scope of impact appears to be growing, with ongoing distribution efforts noted in recent weeks. 1 sources 55

Extracted Entities

Dark Reading: Supercharged Version of Amadey Infostealer and Malware Dropper Bypasses AVs

The full story

Extracted Entities

APT Groups (1)

Attack Types (3)

Countries (4)

Malware (5)

MITRE ATT&CK (5)

Platforms (1)

Ransomware Groups (1)