In interviews with ABC News published Oct 27, Australian Signals Directorate officials described two recent offensive cyber operations against criminals.

• Amadey: ASD operators got into the backend of one criminal's Amadey operation and found it had access to about 180,000 computers worldwide, including in Australia. "The next steps that we took were to disconnect that Amadey controller from all those victims," said acting deputy director-general of intelligence Tauri Gregory. ASD says it found the malware hidden in a pirated copy of Photoshop and being sold on the dark web for about US$500.
• Stolen data: after a tip about the sale of 5 TB of data taken from a business that didn't know it had been hacked, ASD says it broke in and destroyed the data, including about 4.8 million files stolen from Australians.

Context: Amadey is a loader sold as a service since 2018, so each buyer runs its own panel; ESET tracked 53 separate Amadey botnets, and this was one of them. Cutting off a controller does not undo earlier theft, so credentials and session cookies already stolen from those machines may still be used. Amadey infrastructure was also hit by Operation Endgame in June.

What to do: if you find Amadey or StealC on a machine, treat every credential and browser session used on it as stolen. Reset passwords, revoke sessions and tokens, and check for new MFA methods, even after the malware is gone.