What Happened
The Hacker News reports the Australian Signals Directorate gained access to the Amadey operation’s backend and cut its controller off from about 180,000 infected computers. ESET identified 53 separate Amadey botnets with no shared infrastructure, so this action covers one operator, not the whole ecosystem.
Amadey has been sold as a service since 2018. Each buyer runs a command-and-control panel. Its main job is to install other malware, including the StealC infostealer. It also steals credentials and gives remote access. Fake software updates, cracked installers, and other loaders spread it.
Why This Matters for Canadian Organizations
The report does not mention Canada, but the link is direct. Our June coverage noted the RCMP National Cybercrime Coordination Centre joined Operation Endgame against Amadey and StealC. Infections do not stop at borders, so Canadian laptops and servers sit among the infected machines.
Cutting off a controller does not undo earlier theft. Stolen passwords stay valid until someone changes them. Stolen session cookies bypass MFA. Amadey also hands access to other criminals, so a single infection leads to ransomware affiliates months later.
What to Do
Search endpoint telemetry for Amadey and StealC indicators from vendors such as ESET. Reset passwords and revoke sessions for any user on an infected device. Block cracked software and fake updaters with application control. Review how your organization monitors infostealer trends in credential exposure feeds. Report confirmed infections to the Canadian Centre for Cyber Security.
