A significant cybersecurity breakthrough was achieved as the Australian Signals Directorate (ASD) successfully severed connections between the Amadey malware and 180,000 infected computers globally, including systems within Australia. This decisive action has prevented cybercriminals from accessing or stealing data from these compromised devices.
ASD’s Cyber Operation
In an interview with ABC News, Tauri Gregory, ASD’s acting deputy director-general of intelligence, elaborated on the operation conducted on October 27. The agency managed to infiltrate the backend of a criminal operation utilizing Amadey malware and effectively disconnect all associated victim systems.
ASD, known for its role as Australia’s foreign signals intelligence and cyber security agency, undertakes offensive cyber operations with government approval. These operations aim to disrupt international cybercriminal activities by dismantling their infrastructure.
Understanding Amadey Malware
According to an analysis by ESET, Amadey has been available as a service to cybercriminals since 2018. Each purchaser operates their own control panel hosted on separate servers. Infected computers connect to the buyer’s command-and-control (C2) server to execute commands, primarily installing further malware like the StealC infostealer, stealing credentials, and granting remote access.
The malware typically spreads through fake software updates, pirated software installers, and other malicious loaders. ESET’s tracking identified 53 distinct Amadey botnets, each operating independently.
Challenges in Cybersecurity
While disconnecting the malware controller from victim systems halts further exploitation, it does not negate previous breaches. Stolen credentials may remain dormant for extended periods before being utilized by attackers. Microsoft highlights that compromised session cookies can allow attackers to bypass multi-factor authentication (MFA).
ASD’s latest cyber threat report, released on October 27, excluded details of this specific operation. However, in June, Operation Endgame, a collaborative international initiative, targeted Amadey’s infrastructure alongside other malware like StealC and SocGholish.
Although Australia is part of the nine-nation team running Operation Endgame, it was not listed as a participant in the June action week, according to Europol’s announcement.
Additional Cybersecurity Efforts
In a separate incident, ASD reported intercepting a sale of 5 terabytes of stolen data from an unaware business. The agency intervened by destroying the data, which comprised business documents, personal information, and login credentials. This data breach involved approximately 4.8 million files stolen from Australians and numerous others from international victims.
This operation underscores the importance of proactive measures in cybersecurity, highlighting the need for continued vigilance and international cooperation to thwart cyber threats.
