Amadey: Commodity Loader/Botnet Evolved into RAT — Dominant LockBit 3.0 Loader, Adopted by FSB's Secret Blizzard Against Ukrainian Military
Amadey: Commodity Loader/Botnet Evolved into RAT — Dominant (TL-2026-1029), also tracked as Amadey Bot, is a high-severity malware campaign, first published 2026-07-01. It is attributed to Turla - G0010 (Russia) with high confidence, affects Microsoft Windows (32-bit and 64-bit), maps to 35 MITRE ATT&CK techniques (T1005, T1012, T1016), and is covered by 9 detection rules and 30 indicators of compromise.
Key facts for TL-2026-1029
- Threat ID
- TL-2026-1029
- Also known as
- Amadey Bot, Amadey Loader
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- 2026-07-01
- Last reviewed
- 2026-07-01
- Attribution
- Turla - G0010
- Attribution confidence
- HIGH
- Nation-state nexus
- Russia
- Motivation
- ESPIONAGE
- Target sectors
- government administration, defense, military, finance, critical-infrastructure, all-industries
- Target regions
- ukraine, Global
- Detection rules
- 9
- Indicators of compromise
- 30
Malware and tooling in Amadey: Commodity Loader/Botnet Evolved into RAT — Dominant
Malware and tooling: Amadey - S1025, KazuarV2, LockBit 3.0 - S1202, Stealc, Tavdig, Smoke Loader
Amadey, a commodity Malware-as-a-Service loader first observed in October 2018, has evolved into a full-featured RAT with reverse TCP proxying, a TinyNuke-derived hidden VNC module, credential/clipboard theft plugins, and RDP-enablement backdoor account creation. It is the dominant loader for LockBit 3.0 ransomware and was used as unattributable cover infrastructure by the Russian FSB (Center 16)-linked group Secret Blizzard (Turla) to deploy the Tavdig and KazuarV2 backdoors against Ukrainian front-line military devices egressing via Starlink.
How Amadey: Commodity Loader/Botnet Evolved into RAT — Dominant works
Amadey emerged in October 2018 as a commodity Windows malware loader and information stealer sold as Malware-as-a-Service (MaaS) on Russian-language underground forums. Originally a straightforward payload distributor, Amadey has since evolved into a modular, full-featured Remote Access Trojan (RAT) that combines loader, stealer, network-pivoting, and interactive remote-control functionality in a single bot.
The modern bot targets 32-bit Windows primarily, with native 64-bit builds now observed, and is frequently deployed alongside SmokeLoader as an initial infection vector. Core loader functionality allows execution of arbitrary EXE, DLL, CMD, PowerShell, MSI, and ZIP payloads fetched from operator-controlled infrastructure. RAT-grade capabilities layered on top include a native reverse TCP proxy for pivoting into internal networks behind firewalls, a hidden VNC module derived from the leaked TinyNuke source code for stealthy interactive desktop access, creation of backdoor administrative accounts, and RDP enablement via registry modification plus firewall/service reconfiguration.
Information-theft plugins include a credential stealer (cred64.dll) that harvests browser, email, and FTP/SSH credentials, targets cryptocurrency wallets and Telegram session data, and sweeps the Desktop for documents; and a clipboard-clipping module (clip64.dll) that swaps cryptocurrency wallet addresses (Bitcoin, Ethereum, Litecoin, Dogecoin, Monero) copied to the clipboard with attacker-controlled addresses via the Windows GetClipboardData API.
C2 communication is HTTP POST to up to three hardcoded C2 servers over .php endpoints, following a three-stage lifecycle: an initial 'st=s' beacon that queries the sleep interval, an RC4-encrypted registration POST containing a 12 key-value-pair system profile keyed to a unit ID derived from the first 12 numeric characters (offset 5) of the Windows SID, and a tasking response returning numbered command IDs wrapped in <c>/<d> tags and separated by '#'. Notable command IDs include 15/16 (reverse TCP proxy control), 18/19 (self-update/self-remove), 21 (credential stealer launch), 22 (clipboard clipper launch), 23 (hidden VNC activation), and 25 (backdoor admin account creation). Persistence is achieved via HKLM Run registry keys (enabled with a '!' prefix in payload URLs), administrative account creation, RDP auto-start service configuration, and a RunOnce failsafe that wipes the working directory on removal.
Amadey is the dominant loader observed delivering LockBit 3.0 ransomware payloads: malicious Word documents and Word-icon-spoofed executables drop Amadey, which in turn executes 'cc.ps1'/'dd.ps1' PowerShell LockBit droppers or the 'LBB.exe' LockBit binary, abusing the RemoteSigned PowerShell execution policy and using cacls.exe to set read-only permissions that resist deletion.
Separately, between March and April 2024 the Russian FSB (Center 16)-linked espionage actor Secret Blizzard (aka Turla, Waterbug, Venomous Bear, Snake) was observed by Microsoft using the Amadey bot — associated with financially-motivated actor Storm-1919 — either as MaaS or via surreptitious access to Amadey C2 panels, to selectively deploy PowerShell droppers against Ukrainian military devices egressing from Starlink IP ranges (a signature of front-line military connectivity). The intrusion chain progressed from the Amadey/Storm-1837 PowerShell backdoor, to a custom reconnaissance tool ('ddra.exe', RC4-encrypted runtime cmdlets for directory, session, routing-table, and SMB-share enumeration), to the Tavdig backdoor ('rastls.dll') loaded via DLL side-loading into the legitimate Symantec binary kavp.exe, and finally to installation of the persistent KazuarV2 backdoor, which injects into browser processes (explorer.exe, opera.exe) and communicates through compromised WordPress sites acting as C2 relays. Using existing cybercriminal loaders as cover let Secret Blizzard obscure state-sponsored espionage behind commodity-malware noise.
On 2026-06-24, Microsoft's Digital Crimes Unit and Europol's EC3 executed Operation Endgame, a coordinated legal and technical disruption (US District Court case 26-cv-24064-JB, RICO statutes) against Amadey and StealC infrastructure, seizing 47 domains and 182 C2 IPs (34 Amadey core C2 IPs, 69 Amadey task C2 IPs, 79 StealC IPs). Amadey and StealC were linked to over 140,000 infected computers globally in the first two weeks of May 2026 alone, underscoring continued widespread criminal use despite the takedown.
MITRE ATT&CK techniques used in TL-2026-1029
Collection
T1005 Data from Local System; T1115 Clipboard Data
Discovery
T1012 Query Registry; T1016 System Network Configuration Discovery; T1033 System Owner/User Discovery; T1049 System Network Connections Discovery; T1082 System Information Discovery; T1083 File and Directory Discovery; T1135 Network Share Discovery; T1518 Software Discovery; T1614 System Location Discovery
Lateral Movement
Defense Evasion
T1027 Obfuscated Files or Information; T1036 Masquerading; T1140 Deobfuscate/Decode Files or Information; T1497 Virtualization/Sandbox Evasion; T1574 Hijack Execution Flow
Exfiltration
T1041 Exfiltration Over C2 Channel
Persistence
T1053 Scheduled Task/Job; T1112 Modify Registry; T1136 Create Account; T1547 Boot or Logon Autostart Execution
stealth
Execution
T1059 Command and Scripting Interpreter; T1106 Native API
Command and Control
T1071 Application Layer Protocol; T1090 Proxy; T1105 Ingress Tool Transfer; T1219 Remote Access Tools; T1568 Dynamic Resolution
defense-impairment
T1222 File and Directory Permissions Modification; T1553 Subvert Trust Controls
Impact
T1486 Data Encrypted for Impact
Credential Access
T1555 Credentials from Password Stores
Initial Access
Affected products and versions in Amadey: Commodity Loader/Botnet Evolved into RAT — Dominant
- Microsoft — Windows (32-bit and 64-bit)
Vulnerable versions: Windows 7; Windows 8.1; Windows 10; Windows 11; Windows Server
Remediation for Amadey: Commodity Loader/Botnet Evolved into RAT — Dominant
Immediate actions
- Block published Amadey/StealC C2 domains and IPs (Bitsight GitHub threat_research repo, abuse.ch ThreatFox/URLhaus/MalwareBazaar)
- Block known Secret Blizzard Tavdig/KazuarV2 C2 domains: icw2016.coachfederation[.]cz, hospitalvilleroy[.]com[.]br, brauche-it[.]de, okesense.oketheme[.]com, coworkingdeamicis[.]com, plagnol-charpentier[.]fr, vitantgroup[.]com, citactica[.]com
- Hunt for and quarantine known Amadey/Tavdig/KazuarV2/ddra.exe file hashes across endpoints
- Restrict or disable RemoteSigned PowerShell execution policy on endpoints where not required
- Audit for unauthorized local administrator account creation and unexpected RDP-enablement registry/service changes
Workarounds
- Disable macro execution in Microsoft Word for documents from untrusted sources (primary Amadey/LockBit delivery vector)
- Restrict cacls.exe / icacls.exe usage via application control policies to prevent read-only persistence abuse
Longer-term hardening
- Deploy EDR in block mode with attack surface reduction rules for PowerShell obfuscation and PSExec/WMI abuse
- Enable PowerShell module logging and script block logging enterprise-wide
- Deploy network protection to block outbound HTTP POST traffic to known/emerging Amadey-style C2 patterns
- Monitor for DLL side-loading via legitimate signed binaries (e.g., Symantec kavp.exe) in non-standard directories
- Apply enhanced monitoring to devices with satellite/Starlink egress in conflict-zone environments
Weaknesses (CWE) in Amadey: Commodity Loader/Botnet Evolved into RAT — Dominant
CWE-506, CWE-494, CWE-1188
Timeline of Amadey: Commodity Loader/Botnet Evolved into RAT — Dominant
- Amadey malware loader first observed in the wild as a commodity Windows botnet/loader sold via Russian-language underground forums.
- ASEC/security researchers report Amadey bot being used to distribute LockBit 3.0 ransomware via malicious Word documents and PowerShell/exe droppers (cc.ps1, dd.ps1, LBB.exe).
- Secret Blizzard begins abusing the Storm-1837 Telegram-API-based PowerShell backdoor as cover infrastructure, per Microsoft's later disclosure.
- Microsoft observes Secret Blizzard (FSB Center 16 / Turla) leveraging the Amadey bot (Storm-1919) to selectively deploy PowerShell droppers against Ukrainian military devices egressing via Starlink IP ranges.
- Observed window of Secret Blizzard's Amadey-based targeting of Ukrainian front-line military devices closes; intrusion chain proceeds to Tavdig and KazuarV2 backdoor deployment via DLL side-loading.
- KazuarV2 backdoor C2 infrastructure observed active, relaying through multiple compromised WordPress sites (brauche-it[.]de, okesense.oketheme[.]com, coworkingdeamicis[.]com, plagnol-charpentier[.]fr).
- Microsoft publishes 'Frequent freeloader part I,' detailing Secret Blizzard's compromise of Storm-0156 infrastructure for espionage.
- Microsoft publishes 'Frequent freeloader part II,' formally attributing the Amadey/Tavdig/KazuarV2 campaign against Ukrainian military devices to Secret Blizzard and FSB Center 16.
- Amadey and StealC infections linked to more than 140,000 infected computers globally in the first two weeks of May 2026.
- Microsoft's Digital Crimes Unit and Europol's EC3 execute Operation Endgame, a coordinated legal (US case 26-cv-24064-JB, RICO) and technical disruption seizing 47 domains and 182 C2 IPs supporting Amadey and StealC, recovering an estimated 27 million stolen credentials.
- TL-Intel Harness flags Amadey's continued active status, LockBit 3.0 loader dominance, and nation-state adoption by Secret Blizzard for threat intelligence documentation.
Sources cited for Amadey: Commodity Loader/Botnet Evolved into RAT — Dominant
- Amadey Malware Explained: How the Windows Botnet Loader and RAT Work
- Amadey, Software S1025
- Frequent freeloader part II: Russian actor Secret Blizzard using tools of other groups to attack Ukraine
- Frequent freeloader part I: Secret Blizzard compromising Storm-0156 infrastructure for espionage
- Bitsight Aids Disruption Efforts on Amadey & StealC Malware
- Amadey Threat Analysis and Detections
- Experts observed Amadey deploying LockBit 3.0 Ransomware
- Amadey and StealC Malware Network Disrupted, 27M Stolen Credentials Recovered
- Secret Blizzard Targets Ukrainian Military with Custom Malware
- Secret Blizzard Attack Detection: The Russia-Linked APT Group Targets Ukraine via Amadey Malware to Deploy the Updated Kazuar Backdoor Version
- LockBit 3.0 ransomware distributed through Amadey bot
- Operation Endgame Takes Down StealC and Amadey Infostealers
Threats related to Amadey: Commodity Loader/Botnet Evolved into RAT — Dominant
- Operation Endgame Disrupts Amadey Loader and StealC Infostealer Malware-as-a-Service Infrastructure (CVE: N/A)
- Mistic Self-Destructing In-Memory Backdoor (MLTBackdoor) Deployed by KongTuke Access Broker Enabling Multi-Group Ransomware Intrusions
- TELESHIM/MIXEDKEY/BINDCLOAK Multi-Stage Malware Chain Abuses Telegram Bot API for C2 Against Middle East Governments
- GlassWorm v3 Supply Chain Attack — 72 Malicious Open VSX Extensions, 151 GitHub Repos & ZOMBI Botnet Module
- TELESHIM/MIXEDKEY/BINDCLOAK: Unattributed East Asian Threat Actor Targets Middle East Government Entities via DLL Sideloading and Telegram C2
- Armenian National Karen Vardanyan Pleads Guilty to Ryuk Ransomware Conspiracy (District of Oregon)
Detection coverage for TL-2026-1029
As of 2026-07-01, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1029 across Splunk SPL, Microsoft KQL and Sigma, covering 30 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.