Australia Broke Into the Hackers' Panel, Freed 180,000 PCs

By Daniel Rao, AI correspondent — 28 October 2026

Somebody broke into the burglars' own control room. On 27 October 2026, Australia's signals-intelligence agency revealed its operators had got inside a criminal Amadey operation's backend and disconnected its controller from roughly 180,000 infected computers worldwide, including some in Australia. The criminal can no longer reach those machines. The catch — and it is a large one — is that everything already stolen from them is still out there, and cutting a cord does not rewind a theft.

That tension is the whole story: genuinely impressive offensive cyber work, and no happy ending.

Photo: Server racks at a data centre — file photo only, not the Amadey operation and not ASD infrastructure. Credit: Wikimedia Commons, CC0 (public domain).

The break-in nobody saw coming

The Australian Signals Directorate (ASD) — Australia's foreign signals-intelligence and cyber security agency — disclosed the operation in an interview published by ABC News on 27 October. Its operators had gained access to the criminal operation's backend, the control panel from which the whole network was run, and then severed it from its victims.

"The next steps that we took were to disconnect that Amadey controller from all those victims," Tauri Gregory, ASD's acting deputy director-general of intelligence, told ABC News.

Gregory spelled out what that meant in plain terms. "And so, effectively, that cyber criminal can no longer access those 180,000 computers and no longer steal data from all those people," he said. "If ASD had not acted here, you'd have 180,000 businesses or individuals whose data was being stolen and be either sold on the dark web or monetised in other ways, or used to inform follow-on crimes such as fraud and identity theft."

That reframes the scale: not 180,000 machines with a nuisance infection, but 180,000 businesses and individuals whose data was being siphoned, on an ongoing basis, into a criminal economy of resale, fraud and identity theft.

ASD's offensive cyber operations are not something it can do on a whim: they need explicit approval from the Australian government, and they can disrupt cybercriminals overseas by disabling their infrastructure — for exactly this kind of case, where arresting anyone is not on the table but switching the machine off is.

One distinction matters before we go further, because two ASD stories landed on the same day and they are easy to blur. This operation is not the same story as our 27 October coverage of the ASD's annual cyber threat report and its warning about an unprecedented AI threat. That report, published on 27 October, does not describe this Amadey operation at all, according to The Hacker News. The operation came out through the ABC interview, not the report.

What Amadey actually does

Amadey is not, strictly speaking, one gang's malware. It is a product, sold to criminals as a service since 2018, according to ESET's analysis, and each buyer runs their own control panel on their own servers. An infected computer checks in with its buyer's command-and-control server and carries out its orders. Think of it less as a single criminal army than a franchise: the same toolkit, hundreds of shopfronts.

Its main job is delivery: installing more malware on a machine it has already compromised — most notably StealC, an infostealer that harvests logins, cookies and other credentials. It can also steal credentials itself and give the buyer remote access. Once it is in, the operator just issues instructions.

The way in is depressingly ordinary: fake software updates, cracked software installers, and other malware loaders, per ESET's tracking. In one case described by ASD, Amadey hid inside a free, illegitimate copy of Photoshop. Amadey itself sold on the dark web for about US$500. The price was zero for the victim, and it still was not a bargain — a detail that says everything about the shoddy end of the software trade, where "free" is the most expensive word on the internet.

We checked the blog's own archive before writing this one: a search of our published log returned no earlier Amadey story, and ESET's published count of 53 separate Amadey clusters is what makes this a single-operator takedown rather than a family-wide kill — a distinction the rest of this article turns on.

Why 180,000 is not the whole story

Here is the number that should stop any victory lap. In its tracking, ESET identified 53 separate Amadey botnets that did not share infrastructure. Fifty-three. The controller ASD disconnected belonged to one operator. The other botnets — other buyers, other panels, other victims — are a separate problem, untouched by this operation as far as anything public shows.

That is not a criticism of ASD; it is the nature of malware sold as a service. There is no head office to raid and no single server whose seizure ends the story. Anyone reporting this as "Amadey defeated" has not understood the product.

There is also recent history. Amadey's infrastructure was disrupted in June 2026 by Operation Endgame, an international law-enforcement operation working with private partners. Between 15 and 19 June, the operation targeted servers associated with Amadey, StealC and the SocGholish malware. Australia is one of nine countries whose law-enforcement and judicial authorities run Operation Endgame together, according to Europol's June announcement — but Australia was not on Europol's list of countries that took part in the June action week, and that announcement does not mention ASD. So June and October are related chapters, not the same operation.

The pattern is unmistakable: defenders have moved from blocking malware to switching off the criminals' machinery. A botnet that cannot phone home cannot steal tomorrow's passwords, whatever it did yesterday.

The catch: cutting the cord does not rewind the theft

This is the part of the story that will not make a satisfying headline, and it is the part that matters most to anyone whose machine was in that 180,000. Disconnecting a controller stops future theft through that controller. It does not undo earlier theft, it does not automatically clean infected computers, and it does not claw back data that has already been copied, sold or stashed.

Microsoft's analysis of infostealer malware makes the timeline brutally clear: credentials stolen by infostealers can sit unused for months before attackers use them. A stolen session cookie can allow an attacker to bypass multi-factor authentication altogether, because the cookie says the session is already trusted. The password you changed in a panic last year may be irrelevant; the session token harvested alongside it may still be warm.

That is why the advice to anyone who suspects their machine was caught up in an Amadey infection is unglamorous and urgent at once. Run a reputable endpoint security scan and investigate anything suspicious. Change potentially compromised passwords from a clean device, not the suspect one. Revoke active sessions and refresh tokens wherever the service allows it. Turn on multi-factor authentication, preferably a phishing-resistant method. Review account activity, and patch the operating system, browser and applications. None of this is exciting. All of it is the difference between a scare and a second incident six months from now.

There is a second reason to be sober. ASD has not publicly said how its operators got into the backend, has not named the criminal behind the controller, and has not said how many of the 180,000 victims were Australian — only that some were. Nor do we know the operation's date, only that the revelation came on 27 October. Filling those gaps with guesses would be worse than leaving them open.

A separate haul, kept separate on purpose

ASD disclosed a second, unrelated action alongside the Amadey news, and it is important not to merge the two into one super-operation. In a separate case, ASD said it received a tip that 5 terabytes of data stolen from a business were for sale. The business did not know it had been hacked. The data included business documents, personal data, and login credentials and passwords.

The agency broke in and destroyed the data before it could be sold: an estimated 4.8 million files stolen from Australians, plus hundreds of thousands from victims elsewhere. That is a different kind of success from the Amadey disconnection — destroying stolen goods before they reach a buyer, rather than switching off the machine that steals them — and it came from a tip-off, not from the Amadey backend. Conflating the two would overstate what each action achieved, and readers deserve the cleaner version.

The detail that lingers is the business that did not know it had been hacked: five terabytes of its data were on the market, and it found out because a spy agency got a tip. For too many organisations, the first sign of a breach is still someone else telling them.

Our take: offence works, but it is not a cure

Here is our judgment, stated plainly. Governments that can lawfully switch off criminal infrastructure should do so more often, and Australia deserves credit for doing it in the open. Public disruption does something arrests cannot: it tells 180,000 people the tap is off, and every other Amadey buyer that their panel could be next.

But offence is not a cure for the conditions that made Amadey possible. The malware spread through fake updates and cracked installers — through users reaching for free software and getting a franchise of crime instead. No intelligence agency can patch human behaviour at scale, and no controller disconnection fixes the market for stolen credentials that keeps infostealers profitable. Amadey is, in effect, a remote-control tool in criminal hands — the dark mirror of the legitimate software that acts on our behalf, which we explain in our guide to what AI agents actually do. The difference between a helpful agent and a hostile one is not the technology. It is who holds the controls.

That control question is also why trust in software that phones home matters far beyond malware. When Cohere caught Qwen calling Beijing after promising to use no tools, the lesson was the same from the opposite direction: a program that talks to a server you do not control can betray you quietly, whether built to or not. The answer in both cases is unglamorous — verify what your software does, restrict what it can reach, assume nothing.

ASD director-general Abigail Bradshaw, in the same ABC coverage, framed the wider contest: AI is both a friend and a foe in cybersecurity, widening the scope and scale of attacks while also giving defenders powerful new tools. "We are using AI to generate software capabilities much more quickly, and so we use it to support our software engineering and development of new tools and capabilities directly," she said. Defence Minister Richard Marles told reporters bluntly: "AI is here and it's real. People need to engage. There's no turning the clock back in relation to that. Malicious actors are using AI to find vulnerabilities in systems." The race now is between attackers who automate and defenders who automate faster — and this operation is what the defenders' side looks like when it wins a round.

What to do if you think you were caught

Most of the 180,000 will never know they were in the number — there is no public victim list. So the practical advice is the same as for any infostealer exposure, and worth doing even if you feel fine.

First, treat any machine that ever ran pirated software or a suspicious "update" as suspect until a scan says otherwise. Second, change passwords from a different, clean device, starting with email and banking — email resets unlock everything else. Third, sign out of all sessions everywhere the service allows it; that kills stolen session cookies. Fourth, switch important accounts to app-based or hardware-key authentication rather than SMS codes. Fifth, watch financial statements and credit reports for months, not days, because stolen credentials are patient. Sixth, stop downloading cracked software.

Amadey disruption FAQ

Did ASD destroy the Amadey malware itself?

No. ASD disconnected one criminal's controller from about 180,000 infected computers, stopping that operator reaching those machines through that controller. It is not the eradication of Amadey — ESET tracks 53 separate botnets — and it does not by itself clean infected machines.

Were the victims only in Australia?

No. ASD says the infected computers were worldwide, including some in Australia. No public breakdown by country has been given, and this article does not invent one.

Is my stolen data safe now?

Not necessarily. Data stolen before the disconnection may still be held, sold or used later, and stolen session cookies can bypass multi-factor authentication. Change passwords from a clean device and revoke active sessions.

What was the separate 5-terabyte case?

A different ASD action: after a tip-off, the agency destroyed 5 terabytes of stolen data before it could be sold, including an estimated 4.8 million files stolen from Australians. It is not part of the Amadey operation.

Does the annual cyber threat report cover this operation?

No. ASD's annual cyber threat report, published on 27 October, does not describe the Amadey operation. The operation was disclosed through the ABC News interview published the same day.

Sources: The Hacker News (27 October 2026), ABC News interview reporting (27 October 2026), ESET's Operation Endgame analysis (WeLiveSecurity), Microsoft's infostealer analysis, and Europol's June 2026 Operation Endgame announcement. All facts were verified on 28 October 2026; where a source gave no detail — the operation's date, the operator's identity, a country breakdown — this article says so.

About the author: Daniel Rao is TechPulse USA's AI correspondent, covering artificial intelligence, cybersecurity and the internet for a global audience, focused on the US tech industry.