Operation Endgame targeted and disrupted the Amadey botnet and Stealc infostealer, both malware-as-a-service offerings that rely on affiliate networks for deployment. The operation, coordinated by multiple organizations including Microsoft Digital Crimes Unit and ESET Research, took down approximately 50 domains and nearly 200 IP-based command and control servers. Amadey functions primarily as a modular loader distributing an average of 14 payloads per victim and operates on a pay-per-install model. Stealc focuses on credential theft from browsers, crypto wallets, and applications. The disruption leveraged three years of tracking data including encryption keys and campaign identifiers. Due to the decentralized affiliate model, disruption efforts were challenging but impactful.

The operation disrupted the infrastructure of two active malware-as-a-service platforms, Amadey and Stealc, reducing their ability to distribute payloads and steal credentials. This disruption affected approximately 50 domains and nearly 200 command and control servers, thereby limiting ongoing malicious activity. No direct exploits or vulnerabilities in legitimate software were involved. The impact is primarily on the malware operators and their affiliates, reducing their operational capacity.

This is a law enforcement and industry-coordinated disruption operation targeting malware infrastructure. No direct patch or software fix applies. Organizations should continue to apply standard security practices to defend against malware infections. The disruption reduces current threat activity from these malware families. Patch status is not applicable. No further immediate action is required based on this disruption report.