---
title: Australia's ASD says it broke into an Amadey malware operator's backend and disconnected it from 180,000 infected computers, and separately destroyed 5 TB of stolen data before it could be sold | ctxsec
url: https://ctxsec.com/items/asd-offensive-op-amadey-controller-cut-off-180k-computers
description: ""
status: "ASD officials on the record to ABC News (Oct 27); ASD has not published a separate release, and its annual report does not describe the operation"
published: 2026-10-27
---

> 

[← Industry News](/industry) · [markdown](/items/asd-offensive-op-amadey-controller-cut-off-180k-computers.md)

ASD officials on the record to ABC News (Oct 27); ASD has not published a separate release, and its annual report does not describe the operation

2026-10-27

### Australia's ASD says it broke into an Amadey malware operator's backend and disconnected it from 180,000 infected computers, and separately destroyed 5 TB of stolen data before it could be sold

In interviews with ABC News published Oct 27, Australian Signals Directorate officials described two recent **offensive cyber operations** against criminals.

- **Amadey:** ASD operators got into the backend of one criminal's Amadey operation and found it had access to about **180,000 computers** worldwide, including in Australia. "The next steps that we took were to disconnect that Amadey controller from all those victims," said acting deputy director-general of intelligence Tauri Gregory. ASD says it found the malware hidden in a pirated copy of Photoshop and being sold on the dark web for about US$500.
- **Stolen data:** after a tip about the sale of 5 TB of data taken from a business that didn't know it had been hacked, ASD says it broke in and destroyed the data, including about 4.8 million files stolen from Australians.

**Context:** Amadey is a loader sold as a service since 2018, so each buyer runs its own panel; ESET tracked 53 separate Amadey botnets, and this was one of them. Cutting off a controller does not undo earlier theft, so credentials and session cookies already stolen from those machines may still be used. Amadey infrastructure was also hit by Operation Endgame in June.

**What to do:** if you find Amadey or StealC on a machine, treat every credential and browser session used on it as stolen. Reset passwords, revoke sessions and tokens, and check for new MFA methods, even after the malware is gone.

Sources: [ABC News: Disruptions "inevitable" as AI-powered cyber threats grow, Australian Signals Directorate says (Oct 27), with on-record ASD interviews](https://www.abc.net.au/news/2026-10-27/australian-signals-directorate-ai-cybersecurity-hacking-threats/107309858) · [ASD: Offensive cyber operations (what ASD does)](https://asd.gov.au/about/what-we-do/offensive-cyber) · [Europol: Global cyber strike disrupts SocGholish, Amadey and StealC malware networks (June 2026)](https://www.europol.europa.eu/media-press/newsroom/news/global-cyber-strike-disrupts-socgholish-amadey-and-stealc-malware-networks) · [ESET: ESET takes part in Operation Endgame to disrupt Amadey and StealC](https://www.welivesecurity.com/en/eset-research/eset-takes-part-operation-endgame-disrupt-amadey-stealc/)