Microsoft, Europol and Industry Partners Disrupt Amadey and StealC Cybercrime Infrastructure

Surprisingly, global police forces took down two key cybercrime systems at once – unusual given past efforts typically focused on one threat. Backing came from Microsoft, adding weight to actions targeting Amadey, a program that loads malicious software. 

Meanwhile, StealC was also hit; it specializes in stealing user data. Though often seen working hand-in-hand during digital break-ins, both were struck together this time. Shifting tactics like this disrupted not just the tools but their entire support network. Recovery now becomes harder simply because so much of their foundation is gone. 

With infrastructure damaged across multiple points, launching new attacks will take far longer than before.
Microsoft’s Digital Crimes Unit joined forces with law enforcement, cyber defense companies, and intelligence teams to tackle organized digital threats. From the start, findings on Amadey emerged through collaboration between ESET, BitSight, Lumen, and Mitsui Bussan Secure Directions. 

Meanwhile, tracking StealC unfolded thanks to insights from Europol, Germany’s Federal Criminal Police Office, authorities in the Netherlands and Denmark, alongside IBM X-Force and Proofpoint. One thread led to another until distinct probes merged into a clearer picture of an extensive crime network. 

From the start, law enforcement leveraged the RICO Act – typically tied to mob-related prosecutions – to dismantle over 200 command hubs controlling malicious software networks. While not obvious at first glance, patterns uncovered by Microsoft’s Copilot system, driven by artificial intelligence, revealed connections across distinct malware groups. Because of these findings, officials began viewing the threats as branches of one coordinated operation rather than separate incidents. 

Microsoft reported that just in the first week of May, systems tied to Amadey and StealC reached over 140,000 machines globally. Though it appeared only in 2023, StealC functions like a rental-based attack tool – focused on grabbing login details from browsers, crypto wallets, messages, email accounts, even game profiles. 

Those using it adjust their attacks individually, while handling what they collect via online control panels built for ease.
First seen in 2018, Amadey operates by delivering malicious software to compromised devices. Because of its design, cybercriminals often leverage it to introduce programs like StealC. One breach may lead – through this tool – to several layers of intrusion. 

Though initially subtle, the consequences multiply quickly once active.
Modern cybercrime often works like a factory, experts note, where the link between these tools shows how tasks get split up. One crew might build something, another circulate it, while someone else runs it – yet everything fits. Because pieces snap together smoothly, attackers can stack actions into longer sequences even if they never talk. 

The setup thrives on separation, not teamwork.
Targeting entire networks of malicious software could work better than going after single components, Microsoft suggests. Instead of isolated attacks on specific tools, focusing on how these systems connect might weaken criminal infrastructure more deeply. 

When security teams hit several points in an attacker’s process simultaneously, it becomes harder, slower, and costlier to bounce back. Disrupting coordination between different parts slows dow

[…]
Content was cut in order to protect the source.Please visit the source for the rest of the article.