Threat video1:00
Amadey C2 Cut Off from 180,000 Bots: Detection & IOCs
Australian Signals Directorate cut Amadey's operator C2 off from 180,000 infected PCs. The page adds 9 detection rules, 7 IOCs and a free Splunk SPL rule.
Read the full threat intel for Amadey C2 Cut Off from 180,000 Bots: Detection & IOCs →
Chapters
- 0:00The hookASD breached Amadey, disconnecting about 180,000 infected computers.
- 0:06The storyOperation Endgame disrupted Amadey.
- 0:13Attack pathAmadey spreads via fake updates, beacons to control panel.
- 0:29AttributionNo threat actor is attributed.
- 0:33Indicators of compromise1 indicator to hunt: 1 c2 framework.
- 0:39MITRE ATT&CK techniques12 ATT&CK techniques, from execution to command and control.
- 0:43Remediation4 steps now: Identify hosts infected with Amadey or StealC and isolate.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00ASD breached Amadey, disconnecting about 180,000 infected computers.
0:07Operation Endgame disrupted Amadey.
0:10ASD then breached one operator's backend.
0:13Amadey spreads via fake updates, beacons to control panel.
0:17StealC harvests credentials, screenshots.
0:20Proxies enable operator remote access.
0:23ASD breached the backend, halting all command and control.
0:29No threat actor is attributed. Confidence: low.
0:341 indicator to hunt: 1 c2 framework.
0:3912 ATT&CK techniques, from execution to command and control.
0:444 steps now: Identify hosts infected with Amadey or StealC and isolate.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.