The Australian Signals Directorate (ASD) released its 2025-26 Annual Cyber Threat Report this week, and ABC News coverage on October 27 carried details of two offensive operations against cybercriminals that the agency does not usually share. In one, ASD operators got into the back end of an Amadey malware operation and disconnected its controller from about 180,000 infected computers around the world, some of them in Australia. In the other, ASD learned that a stolen 5 TB business data set was up for sale, broke into the system holding it, and destroyed the data.

The operations were described to ABC News. They do not appear in the threat report itself: as The Hacker News points out, the annual report does not describe the Amadey operation. Its foreword mentions in general terms that ASD uses offensive cyber operations to dismantle criminal infrastructure.

What ASD Says It Did

Tauri Gregory, ASD's acting deputy director-general of intelligence, told the ABC that operators accessed the back end of an Amadey operation that had reach into about 180,000 computers worldwide. They then disconnected that Amadey controller from all those victims. The ABC reports that ASD found Amadey hidden in a free, illegitimate version of Photoshop in one case, and found the malware for sale on the dark web for about US$500. The ABC does not say that this Photoshop copy was the source of the 180,000-machine botnet.

The second case started with a tip. ASD was told that 5 TB of data stolen from a business was for sale, and the business did not know it had been hacked. ASD broke in and destroyed the data before it could be sold, the ABC reported. Gregory said the haul included about 4.8 million files stolen from Australians, plus hundreds of thousands of files from victims in other countries. The ABC says the data included business documents, personal data, logins and passwords.

The Hacker News notes that ASD's offensive cyber operations need explicit Australian government approval. That puts this work in a different category from the defensive incident response most readers associate with the agency's Australian Cyber Security Centre (ACSC).

What Amadey Is, and Why One Controller Is Only Part of It

Amadey is a "loader." Its main job is to get a foothold on a PC and then install other malware, such as the StealC information stealer. It can also steal credentials and give operators remote access to infected machines. The Hacker News says, citing ESET's analysis, that Amadey has been sold as a service since 2018. Each buyer runs its own control panel on its own servers, so "Amadey" is really many separate botnets that share a codebase. ESET identified 53 unique clusters inside the Amadey ecosystem.

That structure helps explain why ASD's action reached one operation and not the whole Amadey ecosystem. According to The Hacker News, the most common ways Amadey reached computers were fake software updates, cracked software installers and other malware loaders. Pirated software fits that pattern.

This is also not the first strike on Amadey this year. The Hacker News reports that Operation Endgame, an international law enforcement operation that works with private partners, disrupted Amadey infrastructure between June 15 and 19. ESET, which took part, said the disruption hit around 50 domains and nearly 200 active IP-based command-and-control (C&C) servers used for Amadey or StealC. ESET describes the operation as coordinated by Microsoft's Digital Crimes Unit, BitSight, Lumen, Mitsui Bussan Secure Directions and other partners. According to The Hacker News, Australia is one of nine countries that run Operation Endgame together, but it was not on Europol's list of countries that took part in the June action week, and Europol's announcement does not mention ASD. The public sources do not say whether ASD's operation is connected to Endgame, or when it took place.

The Numbers in the Report

The report's headline numbers show a heavier workload. ASD's ACSC responded to over 1,500 cyber security incidents in 2025-26, an increase of more than 20%. It also notified entities of potential malicious activity more than 4,400 times, almost an 80% increase on the previous year.

In his foreword, Deputy Prime Minister and Defence Minister Richard Marles calls AI the defining force in the cyber threat landscape over the past year, because it lets malicious actors find vulnerabilities faster and exploit them at unprecedented scale, speed and sophistication. He points to joint guidance on AI-related cyber security risks that ASD and its Five Eyes partners released in June 2026. He also cites Project REDSPICE, the government's investment in ASD's capabilities, along with the use of offensive cyber operations to dismantle criminal infrastructure.

ASD director-general Abigail Bradshaw went further in her ABC interview. She said that with each capability increase in AI frontier models, "we are likely to see more disruption," and the ABC's headline calls such disruptions "inevitable." The ABC reported that ASD worked quickly to set up protocols with AI companies, including OpenAI, to act as an "early warning system," and that these protocols have been shared with all of the labs and with the Five Eyes agencies. The ABC also noted that a number of government websites, including ASD's own, were brought partially offline after vulnerabilities were found in a programming language that the ABC's coverage identifies as PHP. Bradshaw cited websites needing to be patched and taken down as an example of the disruption she expects.

Why the Disclosure Matters

The ABC describes the details as previously secret, and ASD appears keen to publicise its offensive successes. Releasing them next to the annual report may be intended to signal to the criminal market that a state agency can reach into its infrastructure, though neither source states that motive. Destroying the 5 TB data set before it sold is also notable because it removed the stolen goods themselves, something a server takedown alone does not do.

The limits matter just as much. Disconnecting a controller stops the operator from accessing those 180,000 machines and stealing more data. As The Hacker News stresses, it does not undo earlier theft.

What It Means for Defenders

Who is affected. Anyone whose machine was part of this Amadey botnet, which the ABC says included computers in Australia. More broadly, anyone running pirated software, cracked installers or "updates" from unofficial sources. The public reporting includes no indicators of compromise, victim lists or notification process for this operation, so organisations cannot check their exposure against ASD's action directly.

Assume credentials are gone, not safe. The Hacker News stresses that cutting off a controller does not undo earlier theft, and that credentials taken by infostealers can sit unused for months before attackers use them. Amadey steals credentials and installs other malware such as StealC. A stolen session cookie can allow an attacker to bypass multi-factor authentication (MFA), according to The Hacker News. If a machine shows signs of infection, or ran software from a dubious source:

  • Rebuild or thoroughly clean the machine before trusting it again.
  • Change passwords for accounts used on that machine, using a different, clean device.
  • Revoke active sessions and tokens for email, cloud, VPN and admin accounts, so stolen cookies stop working. A password reset alone may not do that.
  • Review recent sign-ins and mailbox rules on those accounts for signs of misuse.

Close the front door. The infection routes named in the reporting are fake updates, cracked installers and other loaders. Block unapproved software installs on work machines, and give staff a legitimate way to get the tools they need. A "free Photoshop" is exactly the kind of lure the ABC describes.

Basic hygiene still applies. The report's key actions include enabling MFA or passkeys and following basic cyber security practices such as reviewing privacy settings. Neither protects a session that has already been stolen, which is why revoking sessions matters after an infection.

Plan for faster patch cycles. Bradshaw expects more disruption as AI capabilities increase, and government sites, including ASD's, were taken partly offline while vulnerabilities were fixed. Assume the gap between disclosure and exploitation may keep shrinking. That means knowing what internet-facing software you run, including web stacks like PHP, and being able to patch it quickly. The report also says Australian organisations must embrace AI to improve resilience while preparing for malicious uses of AI by adversaries.

Report it. The report tells organisations and individuals who observe suspicious cyber activity, incidents and vulnerabilities to report to cyber.gov.au or to the Australian Cyber Security Hotline, 1300 CYBER1 (1300 292 371). ACSC also notified entities of potential malicious activity more than 4,400 times in 2025-26. The company whose 5 TB of data ASD destroyed did not know it had been breached, a reminder that theft can go unnoticed.

For CMMC and other compliance programs. A loader infection on a single endpoint is a credential-compromise event, not just a malware ticket. Handle it under your incident response plan. Record the credential and session resets you carry out, and check whether any accounts that touch controlled information were used on the affected machine.

Sources