The Australian Signals Directorate doesn't usually show its cards. So when the ASD publicly confirmed this week that its operators had penetrated the backend infrastructure of an Amadey malware operation — and used that access to sever its control over 180,000 infected computers globally — it was worth paying attention.

Amadey is a modular infostealer-as-a-service platform that's been quietly doing damage since around 2018. It's used to harvest credentials, take screenshots, and drop secondary payloads including ransomware. It's not the flashiest malware in circulation, but it's persistent, cheap to rent, and widely deployed. Think of it as the Toyota HiLux of cybercrime tooling.

What the ASD actually did goes well beyond passive monitoring. According to the agency's own account, Australian operators gained access to the criminal's command-and-control backend — the server that issued instructions to all those infected machines — and then systematically disconnected the botnet. The criminal lost visibility into, and control over, every one of those 180,000 endpoints. Some of the compromised devices were in Australia; the majority were abroad.

This is offensive cyber operations conducted by a government, deployed against a criminal (not a nation-state) target, and disclosed proactively. That's notable on several fronts.

Why it matters. Most Western governments are extremely cagey about offensive operations — even successful ones. Disclosure creates legal complications, exposes tradecraft, and invites scrutiny. The ASD's decision to go public here appears deliberate: it's a signal to the criminal ecosystem that Australian infrastructure is not a quiet backwater, and a signal to domestic stakeholders that the agency's expanded offensive mandate — formalised under the 2023 REDSPICE program — is being used.

It also matters because the alternative is grim. Traditional law enforcement against botnet operators is slow, jurisdiction-dependent, and often ends in takedowns that are rebuilt within weeks. Burning the C2 from the inside is faster and, arguably, more durable — at least until the operator spins up new infrastructure.

The questions this raises are real. The ASD's action affected machines in foreign jurisdictions without those countries' explicit approval, at least as described. That's legally murky territory, even when the outcome is benign for the infected device owners. And while "we cut off the attacker" sounds clean, the infected machines themselves still have Amadey on them — they've just lost their handler, for now.

For Australian organisations, the story is a reminder that Amadey is actively targeting Australian infrastructure and that credential theft remains the dominant entry point for follow-on attacks. If you're running endpoint detection and haven't reviewed infostealer-category alerts recently, that's the action item.

The ASD has not named the specific threat actor behind this campaign. Given Amadey's known distribution through malware-as-a-service marketplaces, the operator could be anywhere — and will almost certainly rebuild.