Amadey

Malware
14 incidents First seen 2026-04-22 Last seen 2026-10-29
Overview

Amadey is a Trojan bot that has been used since at least October 2018.

Investigate in CTI Graph Login required Open in Dashboard
Threat ecosystem
Actors Malware Campaigns CVEs
Tap a node for a quick look · double-tap to open its profile
At a glance
peak priority 190 19 techniques 2 groups use it Windows in ATT&CK since 2022-07-14 updated 2026-05-12 · v1.1
Activity by month (incidents)
2026-042026-10
Sectors targeted
government · 6finance · 4health · 4cryptocurrency · 3manufacturing · 2technology · 2education · 1legal · 1retail · 1
Countries targeted
US · 9CA · 8AU · 6GB · 5IN · 5NL · 4BE · 3CH · 3CN · 3DE · 3DK · 3FR · 3
Origin
RU · 6CA · 4CN · 3US · 3AU · 2GB · 2
Kinds of incident
Malware & Botnets · 7Law Enforcement · 4AI-Enabled Attack · 2DDoS & Disruption · 2Fraud & Crypto Theft · 2Phishing & Social Engineering · 2
Techniques seen in incidents
Phishing · 7T1588.001 - Malware · 7Ransomware · 6Botnet · 4Social Engineering · 4T1059.001 - PowerShell · 4T1059.007 - JavaScript · 4Extortion · 3Impersonate · 3T1566 - Phishing · 3Exfiltration · 2Credential Stuffing · 1Espionage · 1Impersonation · 1
Related actors
Indrik Spider · 1Mustang Panda · 1Mustard Tempest · 1
Related CVEs
CVE-2025-68613 · 1CVE-2026-0300 · 1CVE-2026-17650 · 1CVE-2026-17656 · 1CVE-2026-21858 · 1CVE-2026-3055 · 1CVE-2026-33017 · 1CVE-2026-33824 · 1CVE-2026-34486 · 1CVE-2026-39987 · 1
ATT&CK techniques by tactic (19)
execution T1106 Native API
persistence T1112 Modify Registry T1547.001 Registry Run Keys / Startup Folder
privilege escalation T1547.001 Registry Run Keys / Startup Folder
discovery T1016 System Network Configuration Discovery T1033 System Owner/User Discovery T1082 System Information Discovery T1083 File and Directory Discovery T1518.001 Security Software Discovery T1614 System Location Discovery
collection T1005 Data from Local System
command and control T1071.001 Web Protocols T1105 Ingress Tool Transfer T1568.001 Fast Flux DNS
exfiltration T1041 Exfiltration Over C2 Channel
stealth T1027 Obfuscated Files or Information T1140 Deobfuscate/Decode Files or Information
defense impairment T1112 Modify Registry T1553.005 Mark-of-the-Web Bypass
Groups that use it
KimsukyTA505
Incident timeline
2026-10-29
Australia severs criminal access to 180,000 computers after breaching Amadey malware backend
Data Breaches
2026-10-27
Australia’s Cyber Spy Chief: Expect More Disruption as AI Accelerates Hacking
Security Affairs
2026-10-27
Locked and Loaded: Phishing through Fake Bids and Protected Documents
AlienVault OTX AlienVault OTX TheRecord The Hacker News AlienVault OTX AlienVault OTX
2026-10-27
Australia Gets Into Amadey Malware Backend, Cuts Off Access to 180,000 Infected Computers
The Hacker News
2026-10-20
Inside DarkVision RAT
AlienVault OTX
2026-10-02
Crypto Scammers Hijack Microsoft’s Official X Account
SecurityWeek TheRecord
2026-09-16
AlienVault OTX Dark Reading Dark Reading
2026-07-30
ThreatsDay: AI-Powered Hacking, 370 Chrome Flaws, SonicWall Attacks, DNS Hijacking + 22 More Stories
The Hacker News
2026-06-24
Three ‘cybercrime as a service’ operations undercut by Microsoft, law enforcement
TheRecord
2026-06-24
Europol Disrupts SocGholish Servers, Cleans Malicious TDS Threat
HackRead BleepingComputer Security Affairs Have I Been Pwned Dark Reading CyberScoop Bit Life Media The Hacker News
2026-06-24
Microsoft uses AI to link two malware operations in racketeering suit
The Register - Cybercrime
2026-06-24
In a first, a court takedown goes after two cybercrime tools at once
CyberScoop
2026-06-18
Have I Been Pwned HackRead Security Affairs Infosecurity-Magazine HackRead BleepingComputer
2026-04-22
Malicious trading website drops malware that hands your browser to attackers
Malware Bytes