# Amadey: Commodity Loader/Botnet Evolved into RAT — Dominant LockBit 3.0 Loader, Adopted by FSB's Secret Blizzard Against Ukrainian Military

> Amadey, a commodity Malware-as-a-Service loader first observed in October 2018, has evolved into a full-featured RAT with reverse TCP proxying, a TinyNuke-derived hidden VNC module, credential/clipboard theft plugins, and RDP-enablement backdoor account creation. It is the dominant loader for LockBit 3.0 ransomware and was used as unattributable cover infrastructure by the Russian FSB (Center 16)-linked group Secret Blizzard (Turla) to deploy the Tavdig and KazuarV2 backdoors against Ukrainian front-line military devices egressing via Starlink.

- **Published:** 2026-07-01T00:00:00Z
- **Last reviewed:** 2026-07-01T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1029
- **ID:** TL-2026-1029
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** Turla - G0010 (Russia)
- **Detections:** 9 · **IOCs:** 30 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Amadey emerged in October 2018 as a commodity Windows malware loader and information stealer sold as Malware-as-a-Service (MaaS) on Russian-language underground forums. Originally a straightforward payload distributor, Amadey has since evolved into a modular, full-featured Remote Access Trojan (RAT) that combines loader, stealer, network-pivoting, and interactive remote-control functionality in a single bot.

The modern bot targets 32-bit Windows primarily, with native 64-bit builds now observed, and is frequently deployed alongside SmokeLoader as an initial infection vector. Core loader functionality allows execution of arbitrary EXE, DLL, CMD, PowerShell, MSI, and ZIP payloads fetched from operator-controlled infrastructure. RAT-grade capabilities layered on top include a native reverse TCP proxy for pivoting into internal networks behind firewalls, a hidden VNC module derived from the leaked TinyNuke source code for stealthy interactive desktop access, creation of backdoor administrative accounts, and RDP enablement via registry modification plus firewall/service reconfiguration.

Information-theft plugins include a credential stealer (cred64.dll) that harvests browser, email, and FTP/SSH credentials, targets cryptocurrency wallets and Telegram session data, and sweeps the Desktop for documents; and a clipboard-clipping module (clip64.dll) that swaps cryptocurrency wallet addresses (Bitcoin, Ethereum, Litecoin, Dogecoin, Monero) copied to the clipboard with attacker-controlled addresses via the Windows GetClipboardData API.

C2 communication is HTTP POST to up to three hardcoded C2 servers over .php endpoints, following a three-stage lifecycle: an initial 'st=s' beacon that queries the sleep interval, an RC4-encrypted registration POST containing a 12 key-value-pair system profile keyed to a unit ID derived from the first 12 numeric characters (offset 5) of the Windows SID, and a tasking response returning numbered command IDs wrapped in <c>/<d> tags and separated by '#'. Notable command IDs include 15/16 (reverse TCP proxy control), 18/19 (self-update/self-remove), 21 (credential stealer launch), 22 (clipboard clipper launch), 23 (hidden VNC activation), and 25 (backdoor admin account creation). Persistence is achieved via HKLM Run registry keys (enabled with a '!' prefix in payload URLs), administrative account creation, RDP auto-start service configuration, and a RunOnce failsafe that wipes the working directory on removal.

Amadey is the dominant loader observed delivering LockBit 3.0 ransomware payloads: malicious Word documents and Word-icon-spoofed executables drop Amadey, which in turn executes 'cc.ps1'/'dd.ps1' PowerShell LockBit droppers or the 'LBB.exe' LockBit binary, abusing the RemoteSigned PowerShell execution policy and using cacls.exe to set read-only permissions that resist deletion.

Separately, between March and April 2024 the Russian FSB (Center 16)-linked espionage actor Secret Blizzard (aka Turla, Waterbug, Venomous Bear, Snake) was observed by Microsoft using the Amadey bot — associated with financially-motivated actor Storm-1919 — either as MaaS or via surreptitious access to Amadey C2 panels, to selectively deploy PowerShell droppers against Ukrainian military devices egressing from Starlink IP ranges (a signature of front-line military connectivity). The intrusion chain progressed from the Amadey/Storm-1837 PowerShell backdoor, to a custom reconnaissance tool ('ddra.exe', RC4-encrypted runtime cmdlets for directory, session, routing-table, and SMB-share enumeration), to the Tavdig backdoor ('rastls.dll') loaded via DLL side-loading into the legitimate Symantec binary kavp.exe, and finally to installation of the persistent KazuarV2 backdoor, which injects into browser processes (explorer.exe, opera.exe) and communicates through compromised WordPress sites acting as C2 relays. Using existing cybercriminal loaders as cover let Secret Blizzard obscure state-sponsored espionage behind commodity-malware noise.

On 2026-06-24, Microsoft's Digital Crimes Unit and Europol's EC3 executed Operation Endgame, a coordinated legal and technical disruption (US District Court case 26-cv-24064-JB, RICO statutes) against Amadey and StealC infrastructure, seizing 47 domains and 182 C2 IPs (34 Amadey core C2 IPs, 69 Amadey task C2 IPs, 79 StealC IPs). Amadey and StealC were linked to over 140,000 infected computers globally in the first two weeks of May 2026 alone, underscoring continued widespread criminal use despite the takedown.

## MITRE ATT&CK

- T1566 Phishing
- T1059 Command and Scripting Interpreter
- T1106 Native API
- T1547 Boot or Logon Autostart Execution
- T1136 Create Account
- T1112 Modify Registry
- T1053 Scheduled Task/Job
- T1140 Deobfuscate/Decode Files or Information
- T1027 Obfuscated Files or Information
- T1553 Subvert Trust Controls
- T1497 Virtualization/Sandbox Evasion
- T1574 Hijack Execution Flow
- T1036 Masquerading
- T1222 File and Directory Permissions Modification
- T1555 Credentials from Password Stores
- T1083 File and Directory Discovery
- T1518 Software Discovery
- T1082 System Information Discovery
- T1614 System Location Discovery
- T1016 System Network Configuration Discovery
- T1049 System Network Connections Discovery
- T1033 System Owner/User Discovery
- T1135 Network Share Discovery
- T1012 Query Registry
- T1005 Data from Local System
- T1115 Clipboard Data
- T1071 Application Layer Protocol
- T1105 Ingress Tool Transfer
- T1568 Dynamic Resolution
- T1090 Proxy
- T1219 Remote Access Tools
- T1055 Process Injection
- T1041 Exfiltration Over C2 Channel
- T1486 Data Encrypted for Impact
- T1021 Remote Services

## Sources

- [Amadey Malware Explained: How the Windows Botnet Loader and RAT Work](https://www.picussecurity.com/resource/blog/amadey-malware-explained-how-the-windows-botnet-loader-and-rat-work)
- [Amadey, Software S1025](https://attack.mitre.org/software/S1025/)
- [Frequent freeloader part II: Russian actor Secret Blizzard using tools of other groups to attack Ukraine](https://www.microsoft.com/en-us/security/blog/2024/12/11/frequent-freeloader-part-ii-russian-actor-secret-blizzard-using-tools-of-other-groups-to-attack-ukraine/)
- [Frequent freeloader part I: Secret Blizzard compromising Storm-0156 infrastructure for espionage](https://www.microsoft.com/en-us/security/blog/2024/12/04/frequent-freeloader-part-i-secret-blizzard-compromising-storm-0156-infrastructure-for-espionage/)
- [Bitsight Aids Disruption Efforts on Amadey & StealC Malware](https://www.bitsight.com/blog/bitsight-aids-disruption-efforts-on-amadey-malware-and-stealc-malware)
- [Amadey Threat Analysis and Detections](https://www.splunk.com/en_us/blog/security/amadey-threat-analysis-and-detections.html)
- [Experts observed Amadey deploying LockBit 3.0 Ransomware](https://securityaffairs.com/138292/malware/amadey-malware-deploying-lockbit-3-0.html)
- [Amadey and StealC Malware Network Disrupted, 27M Stolen Credentials Recovered](https://thehackernews.com/2026/06/amadey-and-stealc-malware-network.html)
- [Secret Blizzard Targets Ukrainian Military with Custom Malware](https://www.infosecurity-magazine.com/news/secret-blizzard-ukrainian-military/)
- [Secret Blizzard Attack Detection: The Russia-Linked APT Group Targets Ukraine via Amadey Malware to Deploy the Updated Kazuar Backdoor Version](https://socprime.com/blog/secret-blizzard-attack-detection/)
- [LockBit 3.0 ransomware distributed through Amadey bot](https://www.scworld.com/brief/lockbit-3-0-ransomware-distributed-through-amadey-bot)
- [Operation Endgame Takes Down StealC and Amadey Infostealers](https://www.infosecurity-magazine.com/news/operation-endgame-stealc-amadey/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1029