A Coordinated Strike on Cybercriminal Infrastructure
In a significant victory for international cybersecurity, ESET Research has played a pivotal role in Operation Endgame, a global initiative designed to dismantle the infrastructure behind two prominent Malware-as-a-Service families: the Amadey botnet and the Stealc infostealer.
Coordinated by an international coalition, including Microsoft’s Digital Crimes Unit, Europol’s European Cybercrime Centre, BitSight, Lumen, and various law enforcement agencies across Europe, the operation successfully targeted and rendered inoperative the command-and-control servers that cybercriminal affiliates worldwide relied on.
Both Amadey and Stealc have operated on the MaaS model, where developers sell access to malware and infrastructure to affiliates, who handle the actual distribution and victim targeting.
- Amadey (Modular Loader): Primarily acts as a loader, dropping additional malicious payloads onto compromised systems. It also features modules for clipboard monitoring, credential theft, and VNC-based remote access.
- Stealc (Infostealer): Designed for data exfiltration. It specifically targets sensitive information such as browser credentials, cookies, cryptocurrency wallets, and browser extensions.
ESET has been tracking these two malware families for three years. Their contribution to the disruption was critical, providing law enforcement with high-confidence intelligence:
- Technical Indicators: Detailed analysis of encryption keys, build identifiers, and URL paths.
- Infrastructure Mapping: Identification of command-and-control servers, allowing authorities to act against the criminals’ backend systems.
- Affiliate Insights: Deep analysis of the MaaS ecosystem, including pricing models, communication channels, and common distribution methods (e.g., fake software updates, cracked installers).
By forcing affiliates to rotate infrastructure and disrupting the ability to control compromised machines, operations like these create significant friction for cybercriminals. Amadey required a pay-per-rebuild fee for every change, while Stealc operated on a subscription basis; by seizing their command-and-control infrastructure, the coalition has successfully compromised the financial and operational model of these criminal enterprises.
ESET continues to monitor both malware families to track any potential attempts by the operators to rebuild their infrastructure.
