Cybersecurity
Australia cuts Amadey controller off from infected computers
The Australian Signals Directorate said it reached a criminal Amadey backend and severed its link to 180,000 infected machines worldwide, while warning that earlier thefts could still be used.
- ASD said a criminal using Amadey had been blocked from reaching 180,000 infected computers worldwide, including some in Australia.
- Tauri Gregory said ASD operators accessed the backend and disconnected the controller from those victims.
- ESET said Amadey had been sold as a service in 2018 and that each buyer ran a separate control panel on its own servers.
- ASD separately said it had destroyed 5 terabytes of stolen data before sale, including an estimated 4.8 million files from Australians.
ASD said it had cut a criminal Amadey operation off from 180,000 infected computers around the world, including some in Australia. Tauri Gregory told ABC News that ASD had reached the backend and disconnected the controller from those victims.
The agency said it is Australia’s foreign signals intelligence and cyber security body. Its offensive cyber work needs approval from the Australian government, and it can target overseas criminals by disrupting their infrastructure.
ESET said Amadey had been sold to criminals as a service in 2018, with each customer running a separate control panel on its own servers. The malware checked in with a command-and-control server, installed other malware such as StealC, and could steal credentials and provide remote access.
The article said Amadey’s infrastructure had also been disrupted in June by Operation Endgame, an international law-enforcement operation with private partners. In a separate case, ASD said it had destroyed 5 terabytes of data offered for sale, including an estimated 4.8 million stolen from Australians and hundreds of thousands from other countries.
Named in this story
People
- Tauri Gregory
- ASD’s acting deputy director-general of intelligence who described the disconnection
Companies
- ESET
- security company whose analysis described Amadey’s service model and botnets
- Microsoft
- company whose analysis was cited on stolen credentials and session cookies
Organisations
- Operation Endgame
- international law-enforcement operation that targeted Amadey infrastructure in June
- Europol
- agency that announced which countries were involved in Operation Endgame
Governments and agencies
- Australian Signals Directorate
- Australia’s foreign signals intelligence and cyber security agency that said it cut off Amadey access
- Australian government
- body that must explicitly approve ASD offensive cyber operations
Products and systems
- Amadey
- malware family that infected computers and installed other malware
- StealC
- infostealer that Amadey was used to install
Places
- Australia
- country where some infected computers and stolen files were linked
How the source tells it
The article used a plain, explanatory register and did not lean on a distinct emotive theme.
No emotive framing was found in the original.