Skip to content
Australia Disrupts Amadey Malware, Cuts Off 180,000 Infected Systems

Australia Disrupts Amadey Malware, Cuts Off 180,000 Infected Systems

First seen 28 Oct 2026, 12:38 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 28, 2026 at 13:09 UTC
  • •ASD disconnected 180,000 computers from Amadey malware's control.
  • •Amadey malware primarily spreads through fake updates and cracked software.
  • •53 separate Amadey botnets remain active despite the disruption.

The Australian Signals Directorate (ASD) successfully breached the command-and-control backend of the Amadey malware, disconnecting approximately 180,000 infected computers globally. This operation, which requires government approval, severed the connection between the malware's controllers and the compromised machines. The Amadey malware, identified as a malware-as-a-service since 2018, primarily installs additional malware like StealC and harvests user credentials. It spreads through fake software updates and cracked installers. Despite this disruption, ESET reports that 53 separate Amadey botnets remain operational, and earlier data thefts are unaffected. The operation follows a previous disruption in June during Operation Endgame, which targeted Amadey's infrastructure. ASD's actions highlight the capabilities of intelligence agencies in combating cybercrime.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-06-15
Operation Endgame disrupts Amadey infrastructure
An international law enforcement effort targeted servers linked to Amadey and related malware.
News.Lavx.Hu
2026-10-27
ASD disconnects Amadey controller
Australian Signals Directorate cut off access to 180,000 infected computers worldwide, disrupting a major malware operation.
Thehackernews

More articles in this cluster (3)

Following this threat?

Track Amadey in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (10)

1 / 4

Common questions

What is the Amadey malware?
Amadey is a malware-as-a-service that primarily installs additional malware and steals credentials.
How did ASD disrupt the malware?
ASD accessed the command-and-control backend of Amadey and severed the connection to infected machines.
Are the affected computers still at risk?
Yes, the disruption does not undo previous data thefts, and other Amadey botnets remain active.