Australian Agency Disrupts Amadey Botnet, Halts Access to 180,000 Compromised PCs

The Australian Signals Directorate (ASD) announced on Tuesday that it has successfully infiltrated the command infrastructure of the Amadey malware operation, effectively cutting the criminal's ability to reach roughly 180,000 infected computers worldwide, including a substantial number in Australia.

Amadey is a remote‑access trojan that has been used since at least 2022 to harvest credentials, exfiltrate files and install additional payloads on compromised machines. The malware typically spreads through malicious email attachments and compromised software updates, creating a network of “bot” computers that can be leveraged for data theft or further attacks.

According to the ASD, its cyber‑defence team gained privileged access to the backend servers that the criminal group uses to manage the botnet. By inserting monitoring tools and disabling key control channels, the agency was able to prevent the operators from issuing new commands or retrieving data from the compromised endpoints.

The disruption is expected to halt ongoing data collection from the affected devices, safeguarding personal and corporate information that might otherwise have been siphoned off. While the exact number of Australian machines involved has not been disclosed, the ASD confirmed that the intervention protects a significant portion of the nation’s internet‑connected assets.

Cyber‑security experts note that the move underscores the growing importance of national signals agencies in confronting transnational ransomware and botnet threats. Australia has invested heavily in its cyber‑defence capabilities in recent years, and the ASD’s operation demonstrates the practical outcomes of that strategy.

ASD officials indicated that they will continue to monitor the compromised infrastructure for any attempts at re‑establishment. They also plan to share technical details with international partners, aiming to coordinate a broader takedown of the Amadey ecosystem.

The successful breach of the malware’s command centre sends a clear signal to cyber‑criminals that state‑level actors are capable of turning the tables on illicit operations. Analysts suggest that similar proactive engagements could become a standard tool in the fight against large‑scale botnets, reducing the risk of widespread data breaches in the future.