ASD tells ABC it disconnected an Amadey controller from 180,000 computers; no date or method published

Zero mentions in 126,530 characters: the 180,000 figure lives in one interview

The word Amadey appears zero times in the 126,530 characters of text of the Australian Signals Directorate's own Annual Cyber Threat Report 2025-26 (counted on 29 October 2026, derived), and it is absent from ASD's news release for that report. That absence proves nothing by itself: ABC calls the operation "recent" and gives no date, so it may fall outside what a report titled 2025-26 covers. The figure in the headlines, 180,000 computers, rests on one on the record answer by ASD's acting deputy director-general of intelligence, in an ABC News report published at 18:00 GMT on 26 October 2026, which is 05:00 on 27 October in Sydney (derived). The report says ASD operators reached the back end of an Amadey operation, found that the criminal network "had access to 180,000 computers across the globe, including in Australia", and then disconnected "that Amadey controller from all those victims".

That is a claim by the agency that did it, relayed by a broadcaster. It is not an indictment, a court record, a technical write up or a list of indicators. This briefing reads the ABC report, ASD's own pages and the report text, and then reads what a security firm and a European judicial agency published about Amadey in June, so that the reader can see what the 180,000 might mean and what it cannot. Two secondary reports of the story (DataBreaches.net and The Hacker News) answered with a bot check, so neither was read and nothing below rests on them. Everything was read from 21:09 GMT on 29 October 2026.

The finding is narrow and it matters: if ASD's account is accurate, one Amadey operator lost control of a very large set of infected machines. What it does not establish is that those machines are clean, that the people who own them know, that anyone has been charged, that Amadey as a product is dead, or that the 180,000 is a count of distinct computers rather than something looser. Each of those is taken in turn below.

What ASD is reported to have said, and what it did not say

The ABC report is a long article about ASD's annual threat report and its director-general's warning about AI. The Amadey passage is a few paragraphs. It says that ASD revealed details of a recent effort "to take down criminal groups selling and operating a piece of malware known as Amadey", that Amadey is hidden inside free software and steals personal data or login details, that in one case ASD found it in a free, illegitimate version of Photoshop editing software, and that ASD found evidence of it being sold on the dark web for about US$500. The pictures in the article are credited to ASD as supplied. The article does not give a date for the operation beyond "recent".

Zoom

Two other details are easy to blur. The ABC piece says in a separate paragraph that ASD was tipped off to the sale of 5 terabytes of data stolen from a business, and that it broke in and destroyed the data, with about 4.8 million files from Australians. That is a different case and has no stated link to Amadey. And the ABC's own prose speaks of taking down "criminal groups", plural, while the quoted role holder speaks of a single controller and "that cyber criminal". Only the quoted words describe the act.

Severed is not cleaned: three words doing the work of a control

Three phrases carry a comfort the record does not supply. Takedown suggests the thing is gone, but the quoted act is a disconnection of one controller. Severed access is how some headlines put the same act, and it describes the criminal's position, not the victims'. 180,000 computers reads as a clean count, but the same answer moves to "180,000 businesses or individuals", and the quote then says that without the action their data would be "sold on the dark web or monetised in other ways". The unit is shifting inside one answer.

The strongest form of the claim is the one the role holder gave: the criminal can no longer reach those machines or steal data through them. If true, that stops further theft through that controller. It does not remove the malware, and it does not recall anything already taken. A reader who has Amadey on a machine should not read this as a cure.

The quoted counterfactual is also an estimate, not a measurement: "you'd have 180,000 businesses or individuals whose data was being stolen". It assumes every machine was being actively mined for data. ESET's description of Amadey, below, says the data theft is done by optional plugins and by other malware the loader installs, not by the loader alone.

What Amadey is, and why one controller is not the whole product

ESET Research, in a report of 24 June 2026, describes Amadey as "a modular malware loader" whose "main purpose is to distribute additional malware to compromised systems", with optional modules for clipboard monitoring, credential theft and VNC based remote access. It says the loader has been advertised on a darknet forum since October 2018, that the licence costs US$600 in Bitcoin plus US$50 for each rebuild, and that affiliates deploy and run their own admin panels on their own servers. The ABC reports a sale price of about US$500, so the two prices differ and the record does not say why.

That architecture is why "the Amadey controller" is a phrase with a small referent. ESET found 53 clusters inside the Amadey ecosystem, grouped by the RC4 key built into each sample, with no shared infrastructure between them. The largest was about 34 per cent of the samples ESET processed and distributed around 14 payloads to each victim at once. Which cluster ASD reached is not stated, and nothing in the record lets a reader say it was the largest. If it was one of the small ones, the other 52 are untouched by this account.

Zoom

Zoom

One more item from ESET matters to the 180,000. It says that Amadey checks the keyboard layout and, if it matches a CIS country, silently rejects all network communication. It also says ESET's own detections of Amadey were global, with the highest rates in India, Turkey, Egypt, Mexico and Spain. That is telemetry from ESET's customers, not a map of ASD's 180,000.

June's Operation Endgame also named Amadey, and Australia was not in its list

On 24 June 2026 Eurojust announced another chapter of Operation Endgame, an action week from 15 to 19 June in which "326 servers and 142 domains were neutralised and 27 million compromised data sets were recovered". It names three malware services, SocGholish, StealC and Amadey, and lists the authorities that acted: Germany, Belgium, Denmark, France, the Netherlands, the United Kingdom (its National Crime Agency), the United States and Canada, with Europol. Australia is not listed. ESET, which took part as a private partner, says the disruption affected around 50 domains and nearly 200 active IP addresses used as C&C servers for either Amadey or StealC.

The ASD operation was reported 129 days after the end of that action week (derived: 19 June to 26 October), so it is a later event, and nothing read says whether it targeted a cluster that survived June, was part of it, or was unrelated. ESET said in June that it would "continue to monitor both families and track any attempts to rebuild operational infrastructure". Amadey's operators have a business reason to rebuild: ESET describes a stable customer base and unchanged pricing since the earliest versions.

What can still be on a machine after its controller is cut

ASD's claim is about the criminal's reach. The state of each infected computer is a separate question, and the diagram below keeps the two apart. Everything except the first box rests on ESET's description of Amadey and on plain logic about how a loader works, and it is labelled that way.

Zoom

ESET's technical tables say Amadey "can establish persistence for newly downloaded malware by creating a registry Run key", can "create an administrative account on a compromised system", and, since version 5.03 in October 2024, can run cmd.exe with SYSTEM privileges. A loader with those abilities leaves files, keys and accounts behind. None of that is touched by a change at the controller, and nothing in the ABC account says ASD removed anything from a machine.

The payloads matter most. ESET reports that the largest cluster delivered infostealers, remote access tools and malware packed with complex protectors, and that several Lumma Stealer samples, each tied to a different affiliate, were often delivered to a single victim. Those payloads are other programs with their own servers. It is an inference, not a stated finding, that cutting the Amadey controller leaves them reporting to whoever runs them. A machine that ran Amadey should be assumed to have had at least one second stage unless the owner can show otherwise.

Scale shows why individual notification is a real question. ASD's annual report says its Australian Cyber Security Centre sent more than 4,400 notifications of potentially malicious activity in 2025-26. Notifying 180,000 victims one by one would be about 41 times that number (derived), and most of the 180,000 are not in Australia on the ABC's account of "across the globe". No release says ASD is notifying them, which leaves the owners to find out some other way.

Who is telling the story, and what they gain

ASD is both the actor and the source. The ABC article says the agency is keen to talk up the success of its offensive operations, and the Minister's foreword to the annual report credits ASD with "using offensive cyber operations to dismantle criminal infrastructure used to target Australians" while the report itself does not describe this one. An agency that wants public support and funding for offensive cyber has a reason to present a disruption at its largest scale. That is a reason for care, not a finding that the figure is wrong.

ESET sells security products and detections, and it took part in the June action, so its architecture description is expert but not disinterested. Eurojust is a judicial cooperation agency reporting its own coalition's results. The ABC reported what ASD told it and used ASD's supplied pictures. For a comparable case where a seizure left a criminal host still serving, see the Virtualine domain seizure.

What a defender should do, in order

Technical details

ASD published no indicators, hashes or addresses for this operation in anything read. The artifacts below are ESET's, from its report of 24 June 2026, read 29 October 2026, and they describe Amadey generally, not necessarily the operator ASD reached. Network addresses are defanged and were first seen between 24 February and 13 April 2026, before the June action, so check for current status before blocking. ESET says a fuller list is in its GitHub repository. The wording in each block is copied from ESET unless marked as reworded.

Command and control shape. This is how ESET describes an Amadey bot talking to a server. A defender can look for it in proxy and firewall logs as short HTTP POST requests to a path of random characters ending in index.php, repeated on a timer. The reply format shown is ESET's example for the sleep interval.

C&C URL pattern (ESET):
  http(s)?://<C&C>/<random_path>/index.php

Transport (ESET):
  HTTP POST

Initial beacon (ESET): minimal POST body
  st=s

Example server reply (ESET): sleep interval in minutes
  <c>10<d>

Task strings (ESET): delimited by <c> and <d> tags, individual commands separated by # characters.
sd value (reworded): a six character hexadecimal build identifier sent in the first handshake.
Config (ESET): up to three C&C URLs and an RC4 key per sample; v5.x dominant since the start of 2025.

Amadey network indicators. ESET's table lists these C&C servers. Treat the Cloudflare address as shared infrastructure: blocking a content delivery address can break unrelated sites.

62.60.226[.]159    FEMO IT SOLUTIONS LIMITED     first seen 2026-04-13
94.154.35[.]25     Artem Sevastyanov             first seen 2026-03-26
176.111.174[.]140  RU-NUBES-20220530             first seen 2026-03-04
188.114.96[.]1     Cloudflare, Inc.              first seen 2026-04-02   domain mi.overlapsnowbound[.]com
193.156.1[.]16     RU-PROTON66-20191118          first seen 2026-02-24

Amadey file hashes. ESET lists five SHA1 values for Amadey samples. One of them is printed in ESET's table with 41 characters, which is not a valid SHA1, so it is left out here. The four 40 character values follow, with ESET's detection names.

09002D4668A778853E8DA5C488C6E421C0628357  Win32/TrojanDownloader.Amadey.A
87867AD29E621BF9EBF57E1757F75090842458BE  Win32/TrojanDownloader.Amadey.A
38D744543B2051E6F749AF171B5EF8D6DF8AAC7B  Win64/TrojanDownloader.Amadey.A
FF8D2AFD9D7F0A822092FEE34CA55D1A3542F7ED  Win32/TrojanDownloader.Amadey.A

Behaviours to hunt. ESET's ATT&CK table (version 19) lists these techniques for Amadey. They are behaviours, not signatures, and several are also used by legitimate software, so use them to focus a hunt, not to raise an alert on their own.

T1547.001  Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder  (Run key for newly downloaded malware)
T1136.001  Create Account: Local Account                                          (administrative account on the system)
T1218.007  Signed Binary Proxy Execution: Msiexec                                 (MSI payloads)
T1218.011  Signed Binary Proxy Execution: Rundll32                                (DLL payloads)
T1055.002  Process Injection: Portable Executable Injection                       (payload injected into a child process)
T1059.003  Command and Scripting Interpreter: Windows Command Shell               (cmd.exe)
T1219.002  Remote Access Software: Remote Desktop Software                        (VNC plugin or RDP)
T1480      Execution Guardrails                                                   (aborts on a CIS keyboard layout)

The question that exposes the gap

If a government agency says it has cut a criminal off from your computers but has not said which computers, how it cut them, or whether anyone will tell you, how would your organisation know whether it is one of the 180,000, and what would it do on the day it found out?

Key facts