Global operation disrupts cybercrime assembly line with one-two punch
▼ Summary
– Authorities and private companies disrupted a cybercrime “assembly line” that stole over $47 million and millions of login credentials.
– The operation targeted Amadey, a malware-as-a-service platform, and StealC, an infostealer-as-a-service platform, which are often used together.
– Amadey compromises devices and delivers malicious payloads, while StealC steals credentials, cookies, and cryptocurrency wallets.
– Although run independently, both tools relied on shared underlying infrastructure, which Microsoft identified using AI analysis.
– Microsoft obtained a legal order to disrupt both tools simultaneously, severing a critical link in the cybercrime chain.
International law enforcement agencies, alongside a coalition of private tech firms, have announced the takedown of a cybercriminal “assembly line” responsible for amassing millions of stolen login credentials and extracting over $47 million through ransom payments and other fraudulent schemes.
The coordinated effort centered on a dual strike against two unrelated but frequently paired tools. The first, Amadey, is a malware-as-a-service platform that has been active since at least 2018. It enables attackers to compromise devices and deploy malicious payloads, including ransomware. Last year, it was observed abusing GitHub to harvest system data from infected machines and install tailored malware. The second tool, StealC, operates as an infostealer-as-a-service, designed to swipe passwords, authentication cookies, cryptocurrency wallets, browser extensions, and files matching specific patterns defined by its customers.
Disrupting a critical link in the cybercrime supply chain
Although Amadey and StealC are independent services run by separate operators, their widespread adoption means many cybercriminals use them in tandem. Investigators discovered that both tools relied on overlapping backend infrastructure. Microsoft, after analyzing the tools with AI-driven techniques, identified this shared reliance, enabling its legal team to secure a court order that disrupted both platforms simultaneously.
“This operation targets the cybercrime assembly line, where coordinated tools drive ransomware, financial fraud, and disruptions to public services,” Microsoft stated on Wednesday. “Amadey helps attackers gain access to devices, while StealC steals passwords and sensitive information. Together, they form a critical link in the chain.”
(Source: Ars Technica)
