ASD Disrupts Amadey Malware Backend, Severs 180K Infected Hosts

Tue, 27 Oct 2026 16:34:51 +0000

Engineer — Learn: No patch or config action applies here; note that C2 disruption does not clean infected hosts, so Amadey loaders may still be dormant on endpoints even without callbacks.
SOC/IR — Act: The severed C2 means infections persist without active exfiltration — sweep your estate for Amadey indicators using existing EDR/YARA signatures now, before a new C2 spins up and re-acquires those hosts.
Leader — Learn: A notable government-led botnet disruption at scale; no executive action required unless an internal sweep reveals organizational endpoints were among the 180,000 compromised hosts.

Botnet-Disruption on CuraSec