Threat reportMalwareTL-2026-4775
Amadey MaaS Backend Breached by Australian Signals Directorate; 180,000 Infected Computers Cut Off from Operator C2
The Australian Signals Directorate (ASD) gained access to a criminal operator's Amadey backend and disconnected that Amadey controller from about 180,000 infected computers worldwide, including some in Australia. Amadey, sold as malware-as-a-service since 2018, primarily installs further malware such as the StealC infostealer, and also steals credentials and provides remote access. First disclosed .
Key facts for Amadey botnet backend cutoff
| Identifiers | TL-2026-4775 |
|---|---|
| Also known as | Amadey Bot, Amadey botnet |
| Severity | HIGH |
| First disclosed | |
| Exploitation status | Exploited in the wild |
| Affected products | Microsoft Windows (endpoints infected by Amadey) |
| Malware | Amadey - S1025, SocGholish - S1124, Stealc |
| Tools | Amadey control panel (per-buyer), VNC |
| MITRE ATT&CK techniques | T1005 Data from Local System, T1021.001 Remote Desktop Protocol, T1021.005 VNC, T1059 Command and Scripting Interpreter, T1071.001 Web Protocols, T1082 System Information Discovery, T1090 Proxy, T1113 Screen Capture, T1204.002 Malicious File, T1219 Remote Access Tools, T1539 Steal Web Session Cookie, T1555.003 Credentials from Web Browsers |
| Motivation | FINANCIAL |
| Target sectors | business, consumer, government administration |
| Target regions | Global, australia, india, turkey, egypt, mexico, spain |
| Detection rules | 9 (1 shown free) |
| Sources | 7 cited sources |
Detection coverage for Amadey botnet backend cutoff
As of 2026-10-29, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4775 across Splunk SPL, Microsoft KQL and Sigma, covering 7 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.
Free detection: Browser Credential and Cookie Store Access by Non-Browser Process (StealC/Amadey)
Detects a non-browser process reading two or more browser credential or cookie stores (Chromium Login Data, Cookies, Web Data, Local State; Firefox key4.db, logins.json, cookies.sqlite). StealC and Amadey credential modules harvest these stores, and stolen session cookies can bypass MFA, so defenders should treat hits as credential and session compromise. Requires file-system auditing (SACL) on browser profile directories.
- Languages: Splunk SPL, Microsoft KQL, Sigma
- ATT&CK: T1555.003, T1539, T1005
- Data sources: windows_security_4663, windows_file_system_auditing
- Severity: high
- Confidence: medium
Splunk SPL
index=wineventlog sourcetype="XmlWinEventLog:Security" EventCode=4663 earliest=-24h
| eval obj=lower(ObjectName), proc=lower(ProcessName)
| where match(obj,"(google.chrome|microsoft.edge|bravesoftware|opera software|mozilla.firefox).*(login data|cookies|web data|local state|key4[.]db|logins[.]json|cookies[.]sqlite)$")
| where NOT match(proc,"[^a-z0-9_](chrome|msedge|firefox|brave|opera|msedgewebview2)[.]exe$")
| stats count as accesses dc(obj) as distinct_stores values(obj) as stores_accessed by host SubjectUserName ProcessName
| where distinct_stores>=2Microsoft KQL
SecurityEvent
| where TimeGenerated > ago(24h)
| where EventID == 4663
| where ObjectName matches regex '(?i)(google.chrome|microsoft.edge|bravesoftware|opera software|mozilla.firefox).*(login data|cookies|web data|local state|key4[.]db|logins[.]json|cookies[.]sqlite)$'
| where not(ProcessName matches regex '(?i)[^a-z0-9_](chrome|msedge|firefox|brave|opera|msedgewebview2)[.]exe$')
| summarize Accesses=count(), DistinctStores=dcount(ObjectName), StoresAccessed=make_set(ObjectName, 10) by Computer, SubjectUserName, ProcessName
| where DistinctStores >= 2Sigma
title: Browser Credential And Cookie Store Access By Non-Browser Process
id: 4b7d2f19-8c63-4e05-b1a8-5f2e9d6c3a44
status: experimental
description: Detects a non-browser process accessing browser credential and cookie stores such as Login Data, Cookies, Web Data, Local State, key4.db, logins.json and cookies.sqlite. This is infostealer behavior associated with StealC and Amadey credential modules and enables session cookie theft and MFA bypass. Requires object access auditing on browser profile folders.
references:
- https://www.eset.com/us/about/newsroom/research/eset-takes-part-in-operation-endgame-disrupt-amadey-botnet-and-stealc-infostealer/
- https://thehackernews.com/2026/10/australia-gets-into-amadey-malware.html
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/10/29
tags:
- attack.credential-access
- attack.t1555.003
- attack.t1539
- attack.collection
- attack.t1005
- attack.s1025
logsource:
product: windows
service: security
detection:
selection_event:
EventID: 4663
selection_browser_dir:
ObjectName|contains:
- '\Google\Chrome\'
- '\Microsoft\Edge\'
- '\BraveSoftware\'
- '\Opera Software\'
- '\Mozilla\Firefox\'
selection_store:
ObjectName|endswith:
- '\Login Data'
- '\Cookies'
- '\Web Data'
- '\Local State'
- '\key4.db'
- '\logins.json'
- '\cookies.sqlite'
filter_browser:
ProcessName|endswith:
- '\chrome.exe'
- '\msedge.exe'
- '\firefox.exe'
- '\brave.exe'
- '\opera.exe'
- '\msedgewebview2.exe'
condition: selection_event and selection_browser_dir and selection_store and not filter_browser
falsepositives:
- Endpoint backup, EDR and DLP agents that read browser profile files
- Browser profile migration or password manager import tools
level: high
Known false positives:
- Backup, EDR and DLP agents that read browser profile databases
- Browser profile migration utilities and password-manager import tools
Tuning notes: Enable a SACL for read access on the browser User Data and Firefox Profiles folders or the rule will not fire. Add your EDR, backup and DLP process names to the exclusion list. For raw Splunk Security events using the classic format, rename ObjectName, ProcessName and SubjectUserName to Object_Name, Process_Name and Account_Name.
- Fake Update Script Host Execution from Browser or Archive Download · unlock with TL Creds
- PowerShell Screen Capture and Clipboard Collection (Amadey Collection Modules) · unlock with TL Creds
- VNC or Reverse-Proxy Remote Access by User-Writable Path Process (Amadey Remote Access) · unlock with TL Creds
- Loader Payload Download via LOLBin into User-Writable Path (Amadey Secondary Payload Staging) · unlock with TL Creds
- Host Fingerprinting Burst from User-Writable Path Process (Amadey System Discovery) · unlock with TL Creds
- Periodic HTTP/HTTPS Beaconing from User-Writable Path Process (Amadey Panel C2) · unlock with TL Creds
- Amadey/StealC Loader Delivery - Script Interpreter Spawned from User-Writable Path · unlock with TL Creds
- RDP Enablement on Host via Registry or Firewall Change (Amadey Remote Access) · unlock with TL Creds
Indicators of compromise for Amadey botnet backend cutoff
As of 2026-10-29, Threadlinqs Intelligence tracks 7 indicators of compromise for TL-2026-4775.
How Amadey botnet backend cutoff works
On 2026-10-27 the Australian Signals Directorate (ASD) disclosed, in an ABC News interview and alongside its annual cyber threat report, that it had gained access to the backend of one criminal operator's Amadey malware operation. ASD's acting deputy director-general of intelligence, Tauri Gregory, said ASD then 'disconnected that Amadey controller from all those victims', cutting the operator off from roughly 180,000 infected computers worldwide, including some in Australia. ASD also reported destroying about 5 TB of stolen business data before it could be sold, including about 4.8 million records stolen from Australians plus hundreds of thousands from other countries. ASD's offensive cyber operations require explicit Australian government authorization.
Amadey is a C++ modular loader/backdoor sold as malware-as-a-service since October 2018 (latest version cited by reporting: 5.87). Its primary purpose is to install secondary payloads, most notably the StealC infostealer, and it also offers fingerprinting, file download, command execution, screenshots, SOCKS proxying, VNC/reverse-proxy remote access, clipboard and credential capture, and RDP enablement. ESET reports a pay-per-rebuild licensing model (USD 600 per license plus USD 50 per rebuild). Reporting cites the seller persona 'InCrease' for Amadey and 'plymouth' for StealC. Common delivery routes are fake software updates, cracked software installers, and third-party malware loaders. Amadey has also been used by ransomware gangs and state-sponsored groups to establish footholds.
This action affects only one operator. Each Amadey buyer runs an independent control panel, and ESET identified 53 separate Amadey botnets that do not share infrastructure, so other operators were not affected. Amadey and StealC infrastructure was also disrupted during Europol-coordinated Operation Endgame (2026-06-15 to 2026-06-19), together with SocGholish; published totals differ between sources (e.g. 296 servers/66 domains in one report; 326 servers/142 domains and 27 million recovered credentials in others). ESET observed the highest Amadey detection rates in India, Turkey, Egypt, Mexico and Spain.
Defender impact: although the controller was disconnected, credentials, session cookies and other data already exfiltrated by infected hosts or by StealC may remain exploitable (cookies can bypass MFA). The implants are not stated to be removed from the victim machines, so affected hosts still need cleanup. No CVEs, hashes, domains or IP addresses were published in the cited sources; the IOC set below is therefore limited to malware/tool/persona/behavioral indicators drawn from the sources. No network IOCs were available to check against BeaconBeagle.
MITRE ATT&CK techniques by tactic:
Collection
T1005 Data from Local System; T1113 Screen Capture
Lateral Movement
T1021.001 Remote Desktop Protocol; T1021.005 VNC
Execution
T1059 Command and Scripting Interpreter; T1204.002 Malicious File
Command and Control
T1071.001 Web Protocols; T1090 Proxy; T1219 Remote Access Tools
Discovery
T1082 System Information Discovery
Credential Access
T1539 Steal Web Session Cookie; T1555.003 Credentials from Web Browsers
Remediation for Amadey botnet backend cutoff
Immediate actions
- Identify hosts infected with Amadey or StealC and isolate and reimage them; disruption of one controller does not remove the implant
- Reset passwords and revoke active sessions and tokens for accounts used on infected hosts, since stolen credentials and session cookies remain exploitable
- Re-enroll MFA where session cookie theft is suspected
- Hunt for fake-update, cracked-installer and loader-delivered executables run from user-writable paths
Workarounds
- Restrict VNC, SOCKS proxy and unsanctioned RDP enablement on endpoints
- Block outbound traffic to known Amadey and StealC infrastructure published by Europol and ESET partners
Longer-term hardening
- Block installation of unapproved software and cracked installers via application control
- Deploy EDR with behavioral detection for loader, infostealer and credential-store access activity
- Enforce phishing-resistant MFA and short session lifetimes with token-binding where available
- Monitor for credential exposure using breach-notification feeds
Affected and fixed versions
- Microsoft — Windows (endpoints infected by Amadey)
Vulnerable versions: Not version-specific; user-execution based infection
Timeline of Amadey botnet backend cutoff
- locked-ioc-6, a C++ modular loader/backdoor, first becomes active and begins being sold as malware-as-a-service (activity since October 2018 per reporting).
- locked-ioc-7 infostealer, frequently installed by locked-ioc-6, is first detected (January 2023).
- More than 140,000 infected devices detected during the first two weeks of May 2026, per Operation Endgame reporting.
- Europol-coordinated Operation Endgame begins action against locked-ioc-6, locked-ioc-7 and locked-ioc-3 infrastructure.
- Operation Endgame action window ends; hundreds of servers and domains taken down and roughly 27 million stolen credentials recovered per published reports.
- ESET publishes its role in Operation Endgame, detailing locked-ioc-6 and locked-ioc-7 capabilities, licensing and detection geography.
- ASD discloses it breached one operator's locked-ioc-6 backend, disconnected the controller from about 180,000 infected computers and destroyed about 5 TB of stolen data before sale.
Sources cited for Amadey botnet backend cutoff
- Operation Endgame disrupts the Amadey, StealC and SocGholish malware networks (INCIBE-CERT) incibe.es · Advisory
- ESET takes part in global Operation Endgame to disrupt Amadey botnet and Stealc infostealer eset.com · Vendor report · 2026-06-24
- Australia Gets Into Amadey Malware Backend, Cuts Off Access to 180,000 Infected Computers The Hacker News · News · 2026-10-27
- Amadey and StealC Malware Network Disrupted (The Hacker News) The Hacker News · News
- Amadey, StealC malware operations disrupted in Operation Endgame action (BleepingComputer) BleepingComputer · News
- Risky Bulletin: Law enforcement agencies and security firms take down Amadey and StealerC news.risky.biz · News
- Microsoft, Europol international takedown of infostealer malware (Cybersecurity Dive) cybersecuritydive.com · News
Previous and next in malware
Drafted by the Threadlinqs research pipeline from 7 sources; published ; last updated —.
