The operation aimed to seize or render inoperative all known C&C servers of Amadey and Stealc, directly compromising the infrastructure relied upon by affiliates of both MaaS platforms. ESET Research provided technical analysis, statistics, lists of known C&C servers, encryption keys, campaign identifiers and other details. ESET Research provides insight into the affiliate-level MaaS ecosystem for both malware families in the report
ESET, a global cybersecurity leader, helped dismantle the Amadey botnet and Stealc infostealer by providing technical analysis, infrastructure monitoring and affiliate-level insights. Both are managed as malware as a service (MaaS). The operation – identically ordered by Microsoft's Digital Crimes Unit (DCU), BitSight, Lumen and Mitsui Bussan Secure Directions (MBSD) – targeted all known network infrastructure used by Amadey and Stealc affiliates, in order to cripple their cybercrime operations. At the same time, Europol's European Cybercrime Center (EC3), together with European law enforcement partners, including Germany's Federal Criminal Police Office and the Dutch and Danish national police, were investigating Stealc as part of Operation Endgame, in collaboration with IBM and Proofpoint.
ESET's telemetry detection rate indicates that Amadey malware has been detected globally with no specific concentration in any given region. The highest detection rates were recorded in India, Türkiye, Egypt, Mexico and Spain. Stealc has also been spread globally without a specific concentration in one region, with major detections in the United States, Poland and Italy.
ESET helped counter this threat by providing technical analysis, statistical data, known command and control (C&C) servers, encryption keys, campaign and build identifiers, as well as other threat information gathered during long-term monitoring of both malware families.
"ESET has been monitoring both the Amadey botnet and the Stealc infostealer for three years. For the purposes of the enforcement operation, we have shared statistics covering the period between Q4 2025 and H1 2026, together with technical indicators and configuration data extracted from the analyzed malware samples," explains Jakub Tomanek, ESET researcher.
Tomanek, che collabora alle iniziative volte a contrastare Amadey e Stealc, aggiunge: “I nostri sistemi automatizzati hanno analizzato i campioni di Amadey e Stealc, individuando i campi più rilevanti per il monitoraggio su larga scala. Tra questi figurano i server C&C, gli identificatori delle campagne e altri valori incorporati utilizzati dalle famiglie di malware durante la comunicazione con le infrastrutture controllate dagli autori degli attacchi.”
Sharing technical analysis, statistical data, and threat intelligence, such as C&C server lists, affiliate identifiers, and encryption keys, allows law enforcement to identify, prioritize, and take action against infrastructure with a high degree of certainty.
Amadey is a modular malware loader. Its main purpose is to distribute additional malware on compromised systems, although it also offers modules for data exfiltration and remote access. Stealc, on the contrary, is a typical infostealer as a service. It targets credentials, cookies, cryptocurrency wallets, browser extensions, and files that match affiliate-defined patterns.
Both malware families are sold as services and advertised on darknet forums. In both ecosystems, affiliates receive a self-hosted admin panel that must be deployed on their own server infrastructure. This requires a certain level of technical expertise from affiliates and gives them direct control over victim data and payload distribution.
While distribution methods are ultimately dependent on each individual affiliate, ESET telemetry consistently showed that both malware families were distributed through a wide range of channels. The most common methods included fake software updaters, cracked software installers, and third party malware loaders.
Amadey used a pay-per-rebuild model. Affiliates purchased a license and then paid an additional fee each time they needed to generate a new build, such as when moving to a new C&C server. In other words, Amadey operators were not providing affiliates with a builder tool; instead, the samples were compiled upon request for each affiliate. The service offers three modules for further data exfiltration and access: a clipboard monitoring module, a credential theft module, and a VNC-based remote access module. The service is priced at US$600 in Bitcoin for a single license, with an additional cost of US$50 for each rebuild.
Stealc adottava un approccio più favorevole agli affiliati, offrendo la generazione illimitata di build come parte dell’abbonamento. Ciò riduceva il costo operativo della rotazione dell’infrastruttura C&C e rendeva più semplice per gli affiliati generare nuovi campioni quando necessario. Il malware prende di mira un’ampia gamma di fonti di dati, tra cui le credenziali memorizzate da browser web, client email, client FTP, piattaforme di gaming, file di wallet di criptovalute ed estensioni del browser. Stealc viene venduto tramite abbonamento mensile, con l’offerta più economica pari a 1.000 dollari statunitensi per sei mesi.
Nel tentativo di evitare truffe di impersonificazione, entrambi gli operatori invitavano esplicitamente i potenziali affiliati, sui forum del darknet, a contattarli esclusivamente attraverso canali ufficiali. Amadey indirizzava gli acquirenti verso messaggi privati sul forum del darknet in cui veniva pubblicizzato, mentre Stealc utilizzava messaggi privati sui forum del darknet o Telegram.
ESET continuerà a monitorare entrambe le famiglie malware e a tracciare eventuali tentativi di ricostruire l’infrastruttura operativa in seguito all’operazione di neutralizzazione.
