ASD Takes Down Amadey Back-End, Disrupting 180,000-Machine Botnet

En bref

• ASD obtained access to the Amadey back-end and took its controller offline.
• About 180,000 infected machines were identified across global infections, including Australia.
• The action blocked data theft and disconnected compromised systems from the criminal operator.
• No CVE was involved; defenders should focus on malware remnants and credential exposure.

An operation by the Australian Signals Directorate has disrupted a criminal botnet built on Amadey malware. The agency obtained control of the malware family’s back-end infrastructure and took the command server offline, removing the operator’s ability to direct infected machines. The intervention also prevented data theft and disconnected systems that had been under the criminal’s control.

Roughly 180,000 computers were caught up in the campaign, with infections spread across multiple countries and Australia among those affected. The scale reflects how commodity malware can quietly accumulate victims across sectors, including education and government networks, before an operator monetizes access or steals credentials.

For K-12 IT teams, the disruption lowers immediate risk but does not guarantee that every host is clean. Amadey is often used as a loader or access broker, so machines that were infected may still carry secondary payloads, exposed credentials, or persistence mechanisms. The absence of a CVE in this case means patching alone is not the remedy; endpoint hunting and credential hygiene matter more.

Why it matters: severing the controller breaks the operator’s reach, but residual infections can reconnect to new infrastructure or be re-infected. Watch for unusual outbound traffic, new scheduled tasks or services, and authentication anomalies tied to previously compromised endpoints. Administrators should treat the takedown as a window to verify containment, not as proof that all affected devices are safe.

À faire maintenant

1. Hunt for Amadey artifacts and known indicators across endpoints, then isolate any confirmed infections before rebuilding.
2. Block observed command-and-control domains and IPs at DNS, proxy, and firewall layers, and alert on related outbound patterns.
3. Reset credentials and revoke sessions for users on suspected hosts, prioritizing privileged and email accounts.
4. Review authentication, VPN, and endpoint logs for signs of data access or lateral movement during the infection window.
5. Rebuild rather than clean persistently infected systems, and verify EDR/AV coverage and tamper protection.
6. Brief staff on commodity malware lures and require prompt reporting of suspicious endpoints to the IT security team.

Source originale

The Hacker News