One-two punch delivered in global operation disrupts cybercrime “assembly line”

A coordinated effort by international law enforcement agencies and leading technology firms has successfully dismantled a sophisticated cybercrime network responsible for the theft of millions of login credentials and over $47 million in ransom payments and fraudulent activities. The operation focused on two distinct yet interconnected tools that have been pivotal in various online scams. The first tool, Amadey, operates as a malware-as-a-service platform, enabling cybercriminals to compromise devices and deploy malicious software for ransomware and other illegal schemes. Amadey has been active since at least 2018, with its recent activities including the exploitation of GitHub to gather system information from infected devices and to install tailored malicious payloads. The second tool, StealC, functions as an infostealer-as-a-service platform that targets a wide array of sensitive information. This includes login credentials, authentication cookies, cryptocurrency wallets, browser extensions, and files named according to user-defined criteria. Although Amadey and StealC operate independently, their overlapping usage among cybercriminals has made them a significant threat in the digital landscape. Microsoft played a crucial role in this operation by employing artificial intelligence to analyze the infrastructure supporting these tools. This analysis revealed their shared resources, enabling Microsoft’s legal team to pursue simultaneous disruption measures. "This initiative targets the cybercrime 'assembly line,' where interconnected tools facilitate ransomware attacks, financial fraud, and public service disruptions," Microsoft stated. "Amadey provides attackers access, while StealC captures passwords and sensitive data, making them a vital part of the cybercrime ecosystem."