Australia just cut a malware crew off 180,000 machines, and those boxes are still infected.

The Australian Signals Directorate says its operators got into an Amadey backend and disconnected that controller from every bot it could reach, including hosts in Australia. The criminal on the other end can no longer log in, issue tasks, or steal data through that panel. Celebrate the takedown for about thirty seconds. Then treat every former bot as a compromised asset you have not scoped.

Your cybersecurity team still owns the leftover implant. Amadey is a commodity loader sold to whoever pays. It survives reboot, polls a command server, and pulls the next stage on demand. Stealers. Extra backdoors. Sometimes a ransomware affiliate’s dropper. ASD stopped the live remote-control channel. The scheduled task is still there. The browser vault is still drained. Any second payload that already landed is still running under a user who thinks Tuesday was a normal day.

ASD Cut the Amadey Wire

Lawful access to a criminal panel is rare and useful. ASD used it the right way: yank the controller so 180,000 infected computers stop receiving orders. For a few news cycles, that number will be the story. For you, the number is a lower bound on how many unmanaged, poorly inventoried, or “it’s just a media PC” systems were phoning a crime shop you never heard of.

Amadey does not need a clever exploit to ruin your week. Cracked installers, malvertising, and already-stolen credentials remain the boring path in. Once it is on a box, it blends into routine HTTP. Your firewall often allows the beacon because it looks like a client going outbound. Threat-protection tools that key on live C2 domains will go quiet the moment the panel dies, which is exactly when you need them loud about persistence instead.

The operator lost a dashboard.

You inherited a fleet of untrusted endpoints with a gap in telemetry.

Cybersecurity Work Starts After C2 Dies

This is the part press releases skip. A backend takedown hands incident response a short window where the attacker cannot easily retask the loader through that panel. Use it. Do not wait for a vendor blog to hand you a complete host list. You will not get one that maps to your asset inventory.

The host keeps its implant after the panel goes mute.

Stolen passwords do not expire when a botnet dies. If Amadey or a follow-on stealer already grabbed browser data, VPN profiles, or cloud cookies, those secrets are still in someone else’s folder. Expect brute-force and credential stuffing against anything those users could reach: VPN, RDP, mail, SSO. Your cyber security program has to assume identity is burned on every confirmed loader host, plus any account that machine could touch.

Home PCs that still dial your VPN are in scope. Amadey does not respect your asset owner field in CMDB.

Defense in depth fails here if every layer was watching the same C2 feed. Edge blocks, EDR detections, and threat detection content that only lights up on known Amadey domains will all dim together. The useful signal is host-side: new services, odd scheduled tasks, unsigned binaries in user-writable paths, unexpected child processes off browsers and chat apps. Proof of clean has to come from the host, because a dead controller only proves the attacker lost a dashboard.

Hunt the Loader Then Kill Persistence

Do the ugly host work while the remote-control channel is down.

• Pull an immediate hunt for Amadey-class loaders: persistence in Run keys and scheduled tasks, unexpected binaries under user AppData, and outbound HTTP that started at boot and never belonged to a packaged app. Isolate hits. Snapshot disk before you wipe. Keep the evidence long enough to see what it dropped.
• Rotate credentials and session tokens from every confirmed host, then from every account that host could access. Watch VPN and identity logs for logins that start after the takedown news. Those post-headline logins are the ones that tell you a stealer already cashed out.
• Treat second-stage payloads as the real incident. Look for stealers, additional remote access tools, and anything that phones a different domain than the dead Amadey panel. One loader often means a second family already sitting in the same profile directory.
• Where you cannot prove a host clean, rebuild it from known-good media. Security hardening after rebuild means local admin off standard users, application allow-listing on jump boxes, and software install paths that do not include “free” media tools pulled from random download sites.

Keep that hunt on a schedule. Loaders get cheaply replaced. The next panel will not send you a press release. Ongoing work is boring on purpose: quarterly persistence reviews on high-value endpoints, outbound allow-lists that do not default-permit mystery HTTP from workstations, and an incident response trigger for “public takedown of a loader we have ever seen internally.” That trigger should open tickets.

You will not patch your way out of a loader that users keep inviting back. Shrink the install surface. Make cracked software a firing-offense conversation. Put privileged work on workstations that never browse. None of that is glamorous. It is how you stop paying for the same botnet twice.

Government operators can darken a panel. They cannot run your endpoint inventory, your password reset, or your rebuild queue. That labor is yours, and it starts while the headlines are still warm.

Sources

• Australia Gets Into Amadey Malware Backend, Cuts Off Access to 180,000 Infected Computers