Australia’s signals agency broke into a malware network and cut it off from 180,000 computers

Australia’s signals agency, the Australian Signals Directorate (ASD), got inside the backend of the Amadey malware operation and cut it off from about 180,000 infected computers worldwide. The account comes from Tauri Gregory, ASD’s acting deputy director-general of intelligence, in an ABC News interview published on 27 October 2026. The agency has not said when the operation took place, and the interview calls it only a recent effort.

The day in tech, in one email: TLDR is the daily newsletter with links and TLDRs of the most interesting stories in startups, tech and programming.

Get TLDR →

We may earn a commission if you sign up.

Gregory told ABC News that once ASD operators had access to the criminal’s backend, the next step was to disconnect the Amadey controller from all of its victims, after which that cyber criminal could no longer reach the 180,000 computers. Gregory added that, had the directorate not acted, 180,000 businesses or individuals would have gone on having their data stolen. ASD has published no technical write-up of the operation, so the public record for now is a single interview, a few sentences long, and the reporting built around it.

How Amadey works as a rented botnet

Amadey is malware sold as a service. ESET Research, in a report by Jakub Tomanek and Tomáš Procházka published on 24 June 2026, traced it to a darknet forum account called InCrease that has advertised it since October 2018 at $600 for a single license, paid in Bitcoin, plus $50 for each rebuild. Its main job is to act as a loader that installs further malware, with the StealC infostealer a frequent payload. The directorate’s own account of the disconnection appears only in ABC News coverage of the agency’s cyber operations. The Hacker News reports that infections have typically arrived through fake software updates, cracked software installers or other loaders already on a machine. ESET counted 53 separate Amadey clusters that share no infrastructure, the largest accounting for nearly 34% of the samples it processed and delivering about 14 payloads per victim.

Each buyer runs a control panel on its own servers, and infected machines report to that buyer’s panel. Which of the 53 clusters ASD entered has not been made public.

ESET’s detection data gives a sense of where Amadey operators find victims. The firm saw its highest Amadey detection rates in India, Turkey, Egypt, Mexico and Spain, while StealC, an infostealer first sold on a darknet forum in February 2023 under the name plymouth at $300 a month, was detected most often in the United States, Poland and Italy. ESET identified 73 distinct StealC clusters since March 2025, and its data covers the fourth quarter of 2025 through the first half of 2026. None of that tells a reader where the 180,000 machines ASD cut off were located: the sources say only that they were worldwide and included some in Australia.

The approval behind a hack-back

The Hacker News reports, citing ASD’s page on its offensive cyber operations, that such operations need explicit government approval and are meant to disrupt overseas cybercriminals by disabling their infrastructure. Gregory’s account fits that pattern: access to a criminal’s systems, then a severing of the link to the victims, rather than arrests or server seizures. ASD’s annual cyber threat report, also published on 27 October, does not describe the Amadey action, according to the same reporting, which leaves the interview as the only place the 180,000 figure appears.

Amadey was also hit earlier in the year. Microsoft’s Digital Crimes Unit, BitSight, Lumen, Mitsui Bussan Secure Directions and other partners joined Operation Endgame, which ESET says disrupted about 50 domains and nearly 200 active IP-based command servers used by Amadey and StealC. The Hacker News dates the June action week to 15 through 19 June and says Australia is one of nine countries working together under Endgame, yet ASD is absent from the participant list in Europol’s announcement of the global strike on SocGholish, Amadey and StealC. No source ties the October operation to Endgame, and none rules it out.

Stolen data outlives the takedown

Cutting a controller loose does not claw back what was already taken. Microsoft’s analysis of StealC and Amadey, published in June, describes credentials grabbed by infostealers sitting unused for months, and a stolen session cookie that can let a thief get past multifactor authentication. A computer freed from Amadey can therefore still belong to someone whose passwords and active sessions are circulating among criminals, and nothing in Gregory’s account says the 180,000 owners were notified or told to reset anything.

ASD has described a second kind of intervention in the same reporting. The agency received a tip that 5 TB of data stolen from a business was being offered for sale, although the business did not know it had been breached. ASD broke in and destroyed the data before it could be sold, a haul that included business documents, personal data and login credentials and an estimated 4.8 million records on Australians, plus hundreds of thousands more from victims in other countries.

The one figure every account rests on is the one Gregory gave ABC News: a criminal who, in ASD’s telling, can no longer access 180,000 computers. Missing from it are the date, the operator’s identity, and whether the Amadey loader is still installed on those machines for another buyer to reach.

This article was produced with the assistance of AI and reviewed by Morning Overview editors prior to publication.

The day in tech, in one email: Get TLDR →

We may earn a commission if you sign up.