Australia ASD disconnects Amadey controller from 180,000 infected computers

The Australian Signals Directorate (ASD) said its operators gained access to an Amadey malware operator's backend and disconnected its controller from 180,000 infected computers around the world, including some in Australia, so the criminal can no longer access those computers or steal data from them. Amadey, sold to criminals as a service since 2018, is a loader that installs further malware such as the StealC infostealer, steals credentials and gives buyers remote access. It commonly spreads through fake software updates and cracked software installers, including a fake Photoshop version ASD cited in this case.

In a separate case ASD described at the same time, the agency received a tip that 5 terabytes of data stolen from a business that did not know it had been hacked were for sale, and it broke in and destroyed the data before it could be sold. ASD estimated about 4.8 million of the destroyed files were stolen from Australians, with hundreds of thousands more taken from victims in other countries.

Sources: The Hacker News; ABC News via Europe Says