Amadey is a malware-as-a-service loader active since 2018 that facilitates system access for threat actors to deploy secondary payloads. StealC, active since 2023, is an infostealer used to harvest credentials, cryptocurrency wallets, cookies, and other sensitive data. Both malware families share the same command-and-control infrastructure, which was targeted and disrupted by a coalition including Microsoft, Europol, and cybersecurity firms. The takedown leveraged AI analysis, legal actions, and exploitation of a vulnerability in the StealC C&C panel to upload a web shell, enabling control over the infrastructure. The operation resulted in the seizure of millions of stolen credentials, identification and securing of thousands of compromised computers, and flagging of crypto assets worth over $47 million. This marks a strategic shift from targeting individual threats to dismantling the entire cybercrime assembly line.

The disruption of the shared infrastructure significantly impedes the operation of Amadey and StealC malware campaigns, reducing the ability of cybercriminals to gain access to systems and steal sensitive information. The seizure of over 25 million credentials and identification of 18,000 compromised systems limits ongoing and future attacks. The vulnerability in the StealC C&C panel, while exploited for takedown, was also used maliciously by affiliates to steal data from each other, indicating potential insider threats within the malware ecosystem. The operation also restricts the use of crypto assets valued at over $47 million linked to these campaigns.

This threat has been actively mitigated through a coordinated takedown operation involving law enforcement and cybersecurity companies. The shared command-and-control infrastructure used by Amadey and StealC has been disrupted, and compromised systems have been identified and secured. No additional immediate action is required from defenders specifically for this infrastructure disruption. Organizations should continue to apply standard security practices to prevent infection by these malware families and monitor for any resurgence or new variants.