# Operation Endgame Disrupts Amadey Loader and StealC Infostealer Malware-as-a-Service Infrastructure (CVE: N/A)

> On June 24, 2026, Microsoft's Digital Crimes Unit, Europol EC3, Bitsight TRACE, ESET, IBM X-Force, Proofpoint and law-enforcement partners across Belgium, Canada, Denmark, France, Germany, the Netherlands, the UK and the US executed Operation Endgame actions (June 15-19, 2026) against the Amadey loader/botnet (operator alias "InCrease", active since October 2018) and the StealC information stealer (operator alias "plymouth", active since February 2023), seizing 47 domains and 182 C2 IPs (34 Amadey core C2, 69 Amadey task C2, 79 StealC C2) hosted on shared bulletproof infrastructure. The action recovered roughly 27 million stolen credentials from 385,000+ compromised systems, identified ~$47 million in criminal cryptocurrency, and was filed as a civil RICO complaint (Case No. 26-cv-24064-JB, U.S. District Court, Southern District of Florida).

- **Published:** 2026-07-01T00:00:00Z
- **Last reviewed:** 2026-07-01T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1033
- **ID:** TL-2026-1033
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** InCrease
- **Detections:** 9 · **IOCs:** 27 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Amadey is a C++ modular Windows loader/botnet sold as Malware-as-a-Service on Russian-language cybercrime forums (xss.is, exploit.in) since October 2018 by the actor "InCrease"; the current builder (v5.87) is priced at $600 per license plus $50 per rebuild. It fingerprints the host (OS, architecture, AV products, username, domain, hardware ID), persists via Registry Run/RunOnce keys and scheduled tasks, obfuscates strings and configuration with a Vigenère cipher layered under Base64, and communicates over plain HTTP to per-build hardcoded C2 URLs using structured POST tags (id, vs, sd, os, bi, ar). Its plugin architecture (loaded via rundll32.exe with a "Main" export) adds hVNC, a reverse proxy, a clipboard hijacker (clip64.dll), and a browser credential stealer (cred64.dll) covering Chrome, Firefox, Opera and 10+ other browsers. Amadey is itself frequently used as an initial-access/loader stage to deliver Lumma Stealer, StealC, ransomware affiliates, and — per Microsoft's December 2024 reporting — the Russian FSB-linked APT Secret Blizzard (Turla/Snake/Uroburos), which rode Amadey's MaaS panels to deploy PowerShell droppers and the KazuarV2 backdoor against Ukrainian front-line military systems using STARLINK connectivity between March and April 2024.

StealC, advertised since February 2023 by the actor "plymouth" ($300/month, $700/3-months, $1,000/6-months), is a C++ information stealer with two lineages: v1 (x86, WinINet transport) and v2 (x64, WinHTTP transport, JSON-over-Base64 C2 protocol, released March 2025, current build v2.2.1/v2.2.4). It targets 23+ browsers, 100+ browser extensions, 15+ desktop cryptocurrency wallets, and application data from Discord, FileZilla, Outlook, Steam and Telegram, encrypting strings and C2 traffic with per-sample RC4 keys. Both families implement CIS-country execution guardrails, exiting when the host keyboard layout or UI locale matches Russia, Ukraine, Belarus or Kazakhstan. Distribution is via trojanized/cracked software installers, fake updates, pay-per-install (PPI) affiliate networks, and Amadey itself acting as a secondary loader for StealC.

Operation Endgame's June 2026 action addressed shared bulletproof-hosting infrastructure operated by ELITETEAM (AS56873, Seychelles), Chang Way Technologies (AS59425) and Femo IT Solutions (AS214351). Microsoft's civil complaint independently flagged 200+ malicious C2 domains/IPs and severed 18,000 victim machines from criminal control; ESET separately measured ~50 affected domains and ~200 active C2 servers across 53 distinct Amadey clusters and 73 distinct StealC clusters. Telemetry cited in the disclosures shows roughly 200,000 distinct Amadey-infected IPs sinkholed over a 90-day window (India highest concentration) and 140,000+ combined Amadey/StealC infections in the first two weeks of May 2026 alone (US, Poland and Italy leading StealC infection counts). Community indicator sharing tied to the action included 14,000+ samples to MalwareBazaar, 4,000+ URLs to URLhaus, and 1,800+ indicators to ThreatFox, alongside published YARA/Suricata detection content.

## MITRE ATT&CK

- T1588 Obtain Capabilities
- T1195 Supply Chain Compromise
- T1204 User Execution
- T1106 Native API
- T1059 Command and Scripting Interpreter
- T1129 Shared Modules
- T1547 Boot or Logon Autostart Execution
- T1053 Scheduled Task/Job
- T1140 Deobfuscate/Decode Files or Information
- T1112 Modify Registry
- T1027 Obfuscated Files or Information
- T1553 Subvert Trust Controls
- T1480 Execution Guardrails
- T1222 File and Directory Permissions Modification
- T1555 Credentials from Password Stores
- T1552 Unsecured Credentials
- T1083 File and Directory Discovery
- T1518 Software Discovery
- T1082 System Information Discovery
- T1614 System Location Discovery
- T1016 System Network Configuration Discovery
- T1033 System Owner/User Discovery
- T1021 Remote Services
- T1005 Data from Local System
- T1115 Clipboard Data
- T1071 Application Layer Protocol
- T1568 Dynamic Resolution
- T1105 Ingress Tool Transfer
- T1573 Encrypted Channel
- T1090 Proxy
- T1102 Web Service
- T1041 Exfiltration Over C2 Channel

## Sources

- [Amadey and StealC: Malware-as-a-Service Unavailable](https://malpedia.caad.fkie.fraunhofer.de/library/beebb8e8-26fc-4126-9c9b-061d8a52758f/)
- [Bitsight Aids Disruption Efforts on Amadey Malware and StealC Malware](https://www.bitsight.com/blog/bitsight-aids-disruption-efforts-on-amadey-malware-and-stealc-malware)
- [Operation Endgame Takes Down StealC and Amadey Infostealers](https://www.infosecurity-magazine.com/news/operation-endgame-stealc-amadey/)
- [Amadey and StealC Malware Network Disrupted, 27M Stolen Credentials Recovered](https://thehackernews.com/2026/06/amadey-and-stealc-malware-network.html)
- [Amadey, StealC malware operations disrupted in Operation Endgame action](https://www.bleepingcomputer.com/news/security/amadey-stealc-malware-operations-disrupted-in-operation-endgame-action/)
- [ESET takes part in Operation Endgame to disrupt Amadey and Stealc](https://www.welivesecurity.com/en/eset-research/eset-takes-part-operation-endgame-disrupt-amadey-stealc/)
- [Microsoft and Allies Smash Shared Infrastructure of Amadey and StealC Malware](https://www.securityweek.com/microsoft-and-allies-smash-shared-infrastructure-of-amadey-and-stealc-malware/)
- [ESET Joins Operation Endgame Against Amadey and Stealc](https://securitymea.com/2026/06/29/eset-joins-operation-endgame-against-amadey-and-stealc/)
- [Infostealers StealC and Amadey Disrupted in Police Crackdown](https://www.bankinfosecurity.com/infostealers-stealc-amadey-disrupted-in-police-crackdown-a-32062)
- [Operation Endgame Hits StealC and Amadey: 326 Servers Seized, 27 Million Stolen Credentials Recovered](https://breached.company/operation-endgame-stealc-amadey-takedown-2026/)
- [Amadey, Software S1025](https://attack.mitre.org/software/S1025/)
- [Amadey Threat Analysis and Detections](https://www.splunk.com/en_us/blog/security/amadey-threat-analysis-and-detections.html)
- [Secret Blizzard Deploys Kazuar Backdoor in Ukraine Using Amadey Malware-as-a-Service](https://thehackernews.com/2024/12/secret-blizzard-deploys-kazuar-backdoor.html)
- [Russia's Secret Blizzard APT targets Ukraine with Kazuar backdoor](https://securityaffairs.com/171896/apt/secret-blizzard-targets-ukraine-with-kazuar-backdoor.html)
- [Frequent freeloader part II: Russian actor Secret Blizzard using tools of other groups to attack Ukraine](https://www.microsoft.com/en-us/security/blog/2024/12/11/frequent-freeloader-part-ii-russian-actor-secret-blizzard-using-tools-of-other-groups-to-attack-ukraine/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1033