Indicators of compromise · Stealc +1 — 8 shown
ayelife57[.]resthxxp://144[.]31[.]151[.]8/hxxp://31[.]56[.]19[.]29/hxxp://62[.]60[.]226[.]232/ray-id-v3[.]comhxxp://109[.]238[.]87[.]75/g84kfs5n/index[.]phphxxp://193[.]178[.]158[.]71/b894jfjw/index[.]phphxxp://193[.]178[.]158[.]107/bjsw3dlg1/index[.]php
Defanged third-party indicators (abuse.ch). The defanging is deliberate: never click, resolve or fetch these values. An indicator corroborates a report — it never proves one, and its presence here does not mean this story's hosts are listed.
The Australian Signals Directorate says its offensive cyber operators gained access to the backend of a criminal Amadey botnet operation and disconnected the controller from around 180,000 infected computers worldwide, including machines in Australia. Acting deputy director-general for intelligence Tauri Gregory told ABC News on 27 October that ASD "disconnected that Amadey controller from all those victims". Amadey has been sold to criminals as a service since 2018 — ESET tracks 53 separate botnets, each buyer running its own control panel — with infected machines typically used to drop the StealC infostealer and steal credentials; common delivery vectors are fake software updates, cracked installers and loader malware. ASD's offensive operations require explicit Australian government approval and can disrupt criminal infrastructure overseas, though the agency notes the takedown does not undo earlier theft — session cookies stolen by infostealers can bypass multi-factor authentication months later. The operation follows Operation Endgame's June disruption of Amadey, StealC and SocGholish infrastructure.
| Attribute | Detail |
|---|---|
| Sector | Government |
| Date | 2026-10-28 |
| Source | The Hacker News |
| Reliability | Tier 2 |