Law enforcement and private sector technology companies announced the successful disruption of a coordinated cybercrime operation targeting two widely used malicious tools that have facilitated large-scale fraud and ransomware attacks globally.
The operation focused on Amadey, a malware-as-a-service platform operational since at least 2018, and StealC, an infostealer-as-a-service tool. While developed and operated independently, both platforms share overlapping infrastructure and are frequently deployed together by cybercriminals. Amadey is designed to compromise devices and deliver malicious payloads, while StealC harvests sensitive information including login credentials, authentication data, cryptocurrency wallets, and browser extensions. The shared infrastructure was identified through artificial intelligence analysis, enabling a unified legal approach to disrupt both simultaneously.
Microsoft leveraged findings about the interconnected infrastructure to pursue action under organized crime statutes, treating the tools as part of a single criminal conspiracy. The coordinated effort resulted in the disruption of more than 200 command-and-control servers and severed criminal access to more than 18,000 infected computers. Law enforcement and industry partners collectively took action against 326 additional servers and 142 domains, significantly degrading the malware distribution network.
Europol, coordinating the enforcement action, reported recovery of approximately 27 million stolen login credentials and identification of $47 million in criminal cryptocurrency assets. The operation also targeted SocGholish, a malware loader connected to the Russian cybercrime group Evil Corp., which had been distributed through compromised websites. Response efforts included cleaning infected WordPress sites and notifying affected parties. Participating organizations included ESET, Proofpoint, IBM X-Force, Bitsight, and Mitsui Bussan Secure Directions, with enforcement involvement from Canada, Denmark, Germany, the Netherlands, the UK, and the US.