-
Australia’s spy agency cut an Amadey hacker’s link to about 180,000 infected computers worldwide.
-
The move blocked the hacker’s control, but it did not confirm that the malware was gone.
-
The agency also destroyed millions of stolen files before criminals could sell them.
Australia’s signals intelligence agency has struck back at a hacker who used Amadey malware. The Australian Signals Directorate (ASD) says it cut the criminal off from about 180,000 computers.
The infected computers are in many countries, including Australia. The agency says the action blocked the criminal’s control but did not remove the malware.
Australian agency breaks the hacker’s link to infected computers
According to a report from October 27, ASD operators got into the back end of the criminal operation. They then cut the link between the hacker’s control server and the infected computers. A control server is the machine a hacker uses to send orders. Tauri Gregory, the agency’s acting deputy director-general of intelligence, confirmed the move in an interview.
Gregory said the cut-off stopped the hacker from reaching those computers. The criminal can no longer steal data through that control server. Before the action, the hacker could use it to keep taking information from the victims.
The action did not clean the computers, though. The operation did not show that Amadey is gone from them. It only broke the hacker’s power to control the infected systems through that setup.
ASD is Australia’s foreign signals intelligence and cybersecurity agency. Its attacks on criminal networks need clear approval from the government. These attacks can also reach targets outside the country. The agency cannot launch them without that approval.
The report adds that ASD found Amadey hidden inside a fake free copy of Adobe Photoshop. The agency also saw the malware advertised on the dark web. The reported price was about US$500.
Amadey spreads through fake updates and cracked software
Amadey is a malware loader that works in parts. Think of a loader as a door opener. It gets in first, and then other harmful tools follow. Criminals use it to bring in other harmful software. They also use it to steal information and take remote control of computers.
According to cybersecurity company ESET, Amadey often arrives through fake software updates. Cracked software installers can carry it too. So can other malware loaders. After it installs, Amadey talks to a server that the hacker runs. It receives orders and delivers more malware. One example is StealC, a tool that steals information.
Amadey follows a malware-as-a-service model. Each criminal customer can run a personal control panel and setup. They do not need one central boss for every attack.
This makes a shutdown harder. Closing one hacker’s controller does not stop every other Amadey user. ESET’s research found several separate networks of infected computers. Each one runs on its own. This shows that the Amadey problem is bigger than one hacker.
Another group effort also hit Amadey in June 2026. During Operation Endgame, Microsoft, ESET and other partners worked to disrupt systems linked to Amadey and StealC. Microsoft reported that the two malware families were tied to more than 140,000 infected computers worldwide. That count covers only the first two weeks of May.
The June effort and Australia’s new action are separate events. Available reports do not show that they hit the same hacker’s controller.
Agency destroys millions of stolen files, but earlier theft still matters
ASD also described a second case. In it, the agency received information that about five terabytes of stolen business data were up for sale. The business reportedly did not know that attackers had broken into its systems. The stolen data came from that one business.
The stolen files included business documents and personal information. They also held usernames and passwords. ASD said its operators entered the criminal operation and destroyed the data before any sale took place. In a separate incident, cyberattacks against the European Space Agency reportedly leaked staff data on the dark web.
Gregory said the destroyed material included an estimated 4.8 million files stolen from Australians. Hundreds of thousands of files from victims in other countries were wiped out too. Gregory gave the Australian figure as an estimate. The two cases show two ways that authorities can fight cybercrime. One way cuts criminals off from infected devices. The other stops them from selling what they stole.
Cutting off a controller does not undo earlier theft, though. Criminals may still hold passwords, personal details and other data they took before the action. They can use it later for fraud, account takeovers and identity theft. Fraud means tricking people to get money. An account takeover means a criminal logs in to someone else’s account. Identity theft means a criminal uses another person’s details.
The new action does not prove that stolen passwords are safe. It also does not prove that every infected device is clean. According to the report, three steps still matter when someone suspects an infection. First, remove the malware. Second, check for further signs of a break-in. Third, change any passwords that may be exposed.
In short, Australia blocked one hacker and wiped out a large pile of stolen files. Even so, the danger for victims has not fully gone away.
