# Amadey MaaS Backend Breached by Australian Signals Directorate; 180,000 Infected Computers Cut Off from Operator C2

> The Australian Signals Directorate (ASD) gained access to a criminal operator's Amadey backend and disconnected that Amadey controller from about 180,000 infected computers worldwide, including some in Australia. Amadey, sold as malware-as-a-service since 2018, primarily installs further malware such as the StealC infostealer, and also steals credentials and provides remote access.

- **Published:** 2026-10-29T21:57:19Z
- **Last reviewed:** 2026-10-29T21:57:19Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4775
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-4775.png
- **ID:** TL-2026-4775
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** MONITORING
- **Detections:** 9 (1 shown free below) · **IOCs:** 7

## Description

On 2026-10-27 the Australian Signals Directorate (ASD) disclosed, in an ABC News interview and alongside its annual cyber threat report, that it had gained access to the backend of one criminal operator's Amadey malware operation. ASD's acting deputy director-general of intelligence, Tauri Gregory, said ASD then 'disconnected that Amadey controller from all those victims', cutting the operator off from roughly 180,000 infected computers worldwide, including some in Australia. ASD also reported destroying about 5 TB of stolen business data before it could be sold, including about 4.8 million records stolen from Australians plus hundreds of thousands from other countries. ASD's offensive cyber operations require explicit Australian government authorization.

Amadey is a C++ modular loader/backdoor sold as malware-as-a-service since October 2018 (latest version cited by reporting: 5.87). Its primary purpose is to install secondary payloads, most notably the StealC infostealer, and it also offers fingerprinting, file download, command execution, screenshots, SOCKS proxying, VNC/reverse-proxy remote access, clipboard and credential capture, and RDP enablement. ESET reports a pay-per-rebuild licensing model (USD 600 per license plus USD 50 per rebuild). Reporting cites the seller persona 'InCrease' for Amadey and 'plymouth' for StealC. Common delivery routes are fake software updates, cracked software installers, and third-party malware loaders. Amadey has also been used by ransomware gangs and state-sponsored groups to establish footholds.

This action affects only one operator. Each Amadey buyer runs an independent control panel, and ESET identified 53 separate Amadey botnets that do not share infrastructure, so other operators were not affected. Amadey and StealC infrastructure was also disrupted during Europol-coordinated Operation Endgame (2026-06-15 to 2026-06-19), together with SocGholish; published totals differ between sources (e.g. 296 servers/66 domains in one report; 326 servers/142 domains and 27 million recovered credentials in others). ESET observed the highest Amadey detection rates in India, Turkey, Egypt, Mexico and Spain.

Defender impact: although the controller was disconnected, credentials, session cookies and other data already exfiltrated by infected hosts or by StealC may remain exploitable (cookies can bypass MFA). The implants are not stated to be removed from the victim machines, so affected hosts still need cleanup. No CVEs, hashes, domains or IP addresses were published in the cited sources; the IOC set below is therefore limited to malware/tool/persona/behavioral indicators drawn from the sources. No network IOCs were available to check against BeaconBeagle.

## MITRE ATT&CK

- T1204.002 Malicious File
- T1059 Command and Scripting Interpreter
- T1082 System Information Discovery
- T1555.003 Credentials from Web Browsers
- T1539 Steal Web Session Cookie
- T1113 Screen Capture
- T1005 Data from Local System
- T1071.001 Web Protocols
- T1090 Proxy
- T1219 Remote Access Tools
- T1021.005 VNC
- T1021.001 Remote Desktop Protocol

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Browser Credential and Cookie Store Access by Non-Browser Process (StealC/Amadey)** (`TL-2026-4775-SPL-002`)

Detects a non-browser process reading two or more browser credential or cookie stores (Chromium Login Data, Cookies, Web Data, Local State; Firefox key4.db, logins.json, cookies.sqlite). StealC and Amadey credential modules harvest these stores, and stolen session cookies can bypass MFA, so defenders should treat hits as credential and session compromise. Requires file-system auditing (SACL) on browser profile directories.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1555.003, T1539, T1005
- **Data sources:** windows_security_4663, windows_file_system_auditing
- **Severity:** high
- **Confidence:** medium

### Splunk SPL

```spl
index=wineventlog sourcetype="XmlWinEventLog:Security" EventCode=4663 earliest=-24h
| eval obj=lower(ObjectName), proc=lower(ProcessName)
| where match(obj,"(google.chrome|microsoft.edge|bravesoftware|opera software|mozilla.firefox).*(login data|cookies|web data|local state|key4[.]db|logins[.]json|cookies[.]sqlite)$")
| where NOT match(proc,"[^a-z0-9_](chrome|msedge|firefox|brave|opera|msedgewebview2)[.]exe$")
| stats count as accesses dc(obj) as distinct_stores values(obj) as stores_accessed by host SubjectUserName ProcessName
| where distinct_stores>=2
```

### Microsoft KQL

```kql
SecurityEvent
| where TimeGenerated > ago(24h)
| where EventID == 4663
| where ObjectName matches regex '(?i)(google.chrome|microsoft.edge|bravesoftware|opera software|mozilla.firefox).*(login data|cookies|web data|local state|key4[.]db|logins[.]json|cookies[.]sqlite)$'
| where not(ProcessName matches regex '(?i)[^a-z0-9_](chrome|msedge|firefox|brave|opera|msedgewebview2)[.]exe$')
| summarize Accesses=count(), DistinctStores=dcount(ObjectName), StoresAccessed=make_set(ObjectName, 10) by Computer, SubjectUserName, ProcessName
| where DistinctStores >= 2
```

### Sigma

```yaml
title: Browser Credential And Cookie Store Access By Non-Browser Process
id: 4b7d2f19-8c63-4e05-b1a8-5f2e9d6c3a44
status: experimental
description: Detects a non-browser process accessing browser credential and cookie stores such as Login Data, Cookies, Web Data, Local State, key4.db, logins.json and cookies.sqlite. This is infostealer behavior associated with StealC and Amadey credential modules and enables session cookie theft and MFA bypass. Requires object access auditing on browser profile folders.
references:
    - https://www.eset.com/us/about/newsroom/research/eset-takes-part-in-operation-endgame-disrupt-amadey-botnet-and-stealc-infostealer/
    - https://thehackernews.com/2026/10/australia-gets-into-amadey-malware.html
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/10/29
tags:
    - attack.credential-access
    - attack.t1555.003
    - attack.t1539
    - attack.collection
    - attack.t1005
    - attack.s1025
logsource:
    product: windows
    service: security
detection:
    selection_event:
        EventID: 4663
    selection_browser_dir:
        ObjectName|contains:
            - '\Google\Chrome\'
            - '\Microsoft\Edge\'
            - '\BraveSoftware\'
            - '\Opera Software\'
            - '\Mozilla\Firefox\'
    selection_store:
        ObjectName|endswith:
            - '\Login Data'
            - '\Cookies'
            - '\Web Data'
            - '\Local State'
            - '\key4.db'
            - '\logins.json'
            - '\cookies.sqlite'
    filter_browser:
        ProcessName|endswith:
            - '\chrome.exe'
            - '\msedge.exe'
            - '\firefox.exe'
            - '\brave.exe'
            - '\opera.exe'
            - '\msedgewebview2.exe'
    condition: selection_event and selection_browser_dir and selection_store and not filter_browser
falsepositives:
    - Endpoint backup, EDR and DLP agents that read browser profile files
    - Browser profile migration or password manager import tools
level: high

```

**Known false positives:**

- Backup, EDR and DLP agents that read browser profile databases
- Browser profile migration utilities and password-manager import tools

**Tuning notes:** Enable a SACL for read access on the browser User Data and Firefox Profiles folders or the rule will not fire. Add your EDR, backup and DLP process names to the exclusion list. For raw Splunk Security events using the classic format, rename ObjectName, ProcessName and SubjectUserName to Object_Name, Process_Name and Account_Name.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Fake Update Script Host Execution from Browser or Archive Download (locked: unlock with TL Creds)
- PowerShell Screen Capture and Clipboard Collection (Amadey Collection Modules) (locked: unlock with TL Creds)
- VNC or Reverse-Proxy Remote Access by User-Writable Path Process (Amadey Remote Access) (locked: unlock with TL Creds)
- Loader Payload Download via LOLBin into User-Writable Path (Amadey Secondary Payload Staging) (locked: unlock with TL Creds)
- Host Fingerprinting Burst from User-Writable Path Process (Amadey System Discovery) (locked: unlock with TL Creds)
- Periodic HTTP/HTTPS Beaconing from User-Writable Path Process (Amadey Panel C2) (locked: unlock with TL Creds)
- Amadey/StealC Loader Delivery - Script Interpreter Spawned from User-Writable Path (locked: unlock with TL Creds)
- RDP Enablement on Host via Registry or Firewall Change (Amadey Remote Access) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [Australia Gets Into Amadey Malware Backend, Cuts Off Access to 180,000 Infected Computers](https://thehackernews.com/2026/10/australia-gets-into-amadey-malware.html)
- [Amadey and StealC Malware Network Disrupted (The Hacker News)](https://thehackernews.com/2026/06/amadey-and-stealc-malware-network.html)
- [Amadey, StealC malware operations disrupted in Operation Endgame action (BleepingComputer)](https://bleepingcomputer.com/news/security/amadey-stealc-malware-operations-disrupted-in-operation-endgame-action)
- [ESET takes part in global Operation Endgame to disrupt Amadey botnet and Stealc infostealer](https://www.eset.com/us/about/newsroom/research/eset-takes-part-in-operation-endgame-disrupt-amadey-botnet-and-stealc-infostealer/)
- [Operation Endgame disrupts the Amadey, StealC and SocGholish malware networks (INCIBE-CERT)](https://www.incibe.es/en/incibe-cert/publications/cybersecurity-highlights/operation-endgame-disrupts-amadey-stealc-and-socgholish-malware-networks)
- [Risky Bulletin: Law enforcement agencies and security firms take down Amadey and StealerC](https://news.risky.biz/risky-bulletin-law-enforcement-agencies-and-security-firms-take-down-amadey-and-stealerc/)
- [Microsoft, Europol international takedown of infostealer malware (Cybersecurity Dive)](https://www.cybersecuritydive.com/news/microsoft-europol-international-takedown-infostealer-malware/823655/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4775