Cybersecurity
International operation dismantles dual-tool cybercrime operation behind $47M in theft
Authorities and tech companies shut down Amadey and StealC malware platforms used together to harvest credentials and orchestrate ransomware attacks worldwide.
Ars Technica
Law enforcement and technology firms have successfully disrupted a sophisticated cybercrime operation built on two interconnected tools that worked in tandem to steal credentials and siphon over $47 million through ransomware and fraud.
The coordinated takedown targeted Amadey and StealC—separate-but-complementary malware-as-a-service platforms that cybercriminals routinely deployed together. Amadey specializes in compromising devices and delivering malicious payloads for ransomware campaigns, while StealC functions as an infostealer that harvests passwords, authentication cookies, cryptocurrency wallets, and browser data matching attackers' specifications.
A shared infrastructure revealed by AI#
Although operated independently, the two tools relied on overlapping underlying infrastructure. Microsoft's analysis—aided by AI—identified these critical connections, enabling legal action to disable both platforms simultaneously. "This action goes after the cybercrime 'assembly line,' where coordinated tools drive ransomware, financial fraud, and disruptions to public services," Microsoft said in a statement.
Amadey has circulated in malware ecosystems since at least 2018, and was documented last year exploiting GitHub to distribute system information and custom payloads from compromised devices. The dual-platform model—where Amadey gains initial access and StealC extracts sensitive data—created a potent "critical link in the chain" that fueled large-scale criminal operations globally.
