Amadey botnet: Australian Signals Directorate severs C2 access to ~180,000 infected computers
Severity: medium · Patch status: no-fix-needed · Since 2026-10-29
The Australian Signals Directorate gained access to the backend of the Amadey malware operation and disconnected its command-and-control server from roughly 180,000 infected victim computers, cutting criminals' remote access to those machines. Amadey is a commodity malware loader used to deliver additional payloads such as infostealers and ransomware. The victims are a large, anonymous, multinational set of compromised computer owners rather than a single named organisation. The action is a disruption, not a vendor fix: infected hosts remain compromised locally, and the underlying infections that allowed Amadey in still need remediation. No CVE applies; exploitation was ongoing in the wild until the takedown.
What to do
- Check endpoints for Amadey and other malware indicators and fully remediate any infections rather than assuming disconnection from C2 means clean
- Harden initial-infection vectors Amadey typically uses (phishing, cracked software, exposed RDP) with MFA, patching, and RDP restrictions
- Monitor for reconnection attempts to known Amadey C2 infrastructure and block related indicators
- Report suspected infections to national CERT/authorities to support further disruption efforts
Sources
All live incidents on Threat Watch
