The Australian Signals Directorate says it accessed the back end of an Amadey malware operation and disconnected its controller from about 180,000 computers worldwide, including some in Australia.
Australia's signals intelligence agency says it has cut a cybercriminal off from roughly 180,000 computers infected with Amadey malware around the world. In an interview with ABC News published on 27 October 2026, Tauri Gregory, the Australian Signals Directorate's acting deputy director-general of intelligence, said ASD operators gained access to the back end of the operation and disconnected the Amadey controller from its victims. "That cyber criminal can no longer access those 180,000 computers and no longer steal data," he said. The infected machines include some in Australia, and ASD described the work as a recent effort without giving a date.
Amadey is data-stealing malware that is sold on the dark web for about US$500 and is often hidden inside free or pirated software; ASD said it found it in an illegitimate version of a Photoshop-style editing program. Stolen personal data and login details are sent back to criminals and sold. Gregory said that without ASD's action the victims' data could have been sold on the dark web, monetised in other ways or used for crimes such as fraud and identity theft. Security outlet The Hacker News, which reported the story, noted that cutting off a controller does not undo past theft, since stolen credentials can sit unused for months, and that ESET has tracked dozens of separate Amadey botnets, so this was one operator among many.
Gregory also described a separate case in which ASD was tipped off that 5 terabytes of data stolen from a business, which did not know it had been breached, were up for sale. ASD broke in and destroyed the data before it could be sold; he estimated that about 4.8 million stolen files belonging to Australians were among those destroyed, plus hundreds of thousands from victims elsewhere. The disclosures came as ASD published its annual cyber threat report, and the figures are ASD's own account, as the agency's offensive operations are not independently audited in public.
