Act
active
ASD Disrupts Amadey Malware Backend, Severs 180K Infected Hosts
- Engineer — Learn: No patch or config action applies here; note that C2 disruption does not clean infected hosts, so Amadey loaders may still be dormant on endpoints even without callbacks.
- SOC/IR — Act: The severed C2 means infections persist without active exfiltration — sweep your estate for Amadey indicators using existing EDR/YARA signatures now, before a new C2 spins up and re-acquires those hosts.
- Leader — Learn: A notable government-led botnet disruption at scale; no executive action required unless an internal sweep reveals organizational endpoints were among the 180,000 compromised hosts.
This entry was curated and judged by AI (Claude) with automated enrichment
(CISA KEV / EPSS / public PoC). Verify against the original source before
acting. Found a bad verdict?
Report it —
confirmed errors go to the corrections log.