Australia Disrupts Amadey Malware Backend, Cutting Off 180,000 Infected Computers

The Australian Signals Directorate (ASD) said a criminal using Amadey malware can no longer access or steal data from 180,000 infected computers worldwide, including some in Australia. Agency operators gained access to the operation's backend and cut it off from those computers, according to Tauri Gregory, ASD's acting deputy director-general of intelligence. Gregory told ABC News in an interview published on October 27 that the next steps were to disconnect that Amadey controller from all those victims.

How ASD Disrupted the Controller

ASD is Australia's foreign signals intelligence and cyber security agency. Its offensive cyber operations need explicit approval from the Australian government and can disrupt cybercriminals overseas by disabling their infrastructure. Gregory told ABC News that operators gained access to the criminal's operation's backend before disconnecting it from infected machines.

What Amadey Does

Amadey was sold to criminals as a service in 2018, according to ESET's analysis. Each buyer runs its own control panel on its own servers, and infected computers check in with the buyer's command-and-control server and carry out its orders. Amadey's main job is to install more malware, such as the StealC infostealer; it can also steal credentials and give the buyer remote access to the machine.

The most common ways Amadey reached computers were fake software updates, cracked software installers, and other malware loaders. The criminal's operation was one of many, and ESET identified 53 separate Amadey botnets that did not share infrastructure.

Limits of the Disruption

Disconnecting a controller from its victims does not undo earlier theft. Credentials stolen by infostealers can sit unused for months before attackers use them, according to Microsoft's analysis, and a stolen session cookie can allow an attacker to bypass multi-factor authentication.

ASD's annual cyber threat report, published on October 27, does not describe the operation. Amadey infrastructure was also disrupted in June by Operation Endgame, an international law enforcement operation that works with private partners. Between June 15 and 19, that operation targeted servers associated with Amadey, StealC, and the SocGholish malware.

Operation Endgame and a Separate Case

Australia is one of nine countries whose law enforcement and judicial authorities run Operation Endgame together, according to Europol's June announcement. Australia was not on Europol's list of countries that took part in the June action week, and the announcement does not mention ASD.

In a separate case, ASD said it received a tip that 5 terabytes of data stolen from a business were for sale. The business did not know it had been hacked, and the data included business documents, personal data, and login credentials and passwords. The agency broke in and destroyed the data before it could be sold; the destroyed files included an estimated 4.8 million files stolen from Australians and hundreds of thousands taken from victims in other countries.

Sources: The Hacker News