Australia's spy agency cuts a hacker off from 180,000 infected computers

Australia's signals intelligence agency says it broke into a criminal's control system and cut it off from 180,000 infected computers around the world. The criminal used a piece of malware called Amadey. According to the agency, he can no longer reach those machines or steal data from them. Some of the computers are in Australia.

What happened

The Australian Signals Directorate (ASD) is the country's foreign spy agency for electronic communications and its cyber security agency. Its operators got into the backend of the criminal's Amadey operation. Tauri Gregory, ASD's acting deputy director-general of intelligence, told ABC News the next step was to disconnect the Amadey controller from all those victims. The interview was published on October 27.

What Amadey does

Amadey was sold to criminals as a service starting in 2018, according to security firm ESET. Each buyer runs a control panel on its own servers. Infected computers check in with that server and follow its orders. Its main job is to install more malware, such as a password stealer called StealC. It can also steal logins and give the buyer remote access to the machine.

The most common ways it reached computers were fake software updates, cracked software installers, and other malware loaders. Cracked software means pirated copies of paid programs with the copy protection removed.

A bigger picture

This was one operation among many. ESET found 53 separate Amadey botnets, which are networks of infected computers, that did not share infrastructure. Amadey was also hit in June by Operation Endgame, an international law enforcement effort. Between June 15 and 19 it targeted servers tied to Amadey, StealC and SocGholish malware.

Australia is one of nine countries in Operation Endgame. It was not on Europol's list of countries in the June action week, and Europol's announcement does not mention ASD.

A separate case

ASD also said it got a tip that 5 terabytes of data stolen from a business were up for sale. The business did not know it had been hacked. The data included business documents, personal data, logins and passwords. The agency broke in and destroyed the data before it could be sold. It estimates the files included 4.8 million taken from Australians, plus hundreds of thousands from victims in other countries.

What is not known

• Who the criminal is, and whether he can rebuild the operation.
• Whether the malware was removed from the 180,000 computers.
• How ASD got in. Its annual cyber threat report, also published October 27, does not describe the operation.