A global law enforcement operation, dubbed Operation Endgame, has successfully dismantled significant criminal infrastructure used by the Amadey and StealC malware families. Coordinated by Europol and supported by private sector partners like Microsoft and Bitdefender, the action resulted in the seizure of over 300 servers, 142 domains, and the restriction of $47 million in illicit cryptocurrency. The operation recovered 27 million stolen credentials and effectively disrupted the "assembly lines" used for ransomware and financial fraud.
Amadey and StealC operate under a Malware-as-a-Service (MaaS) model, with Amadey functioning as a modular loader and StealC as a specialized infostealer. These threats have compromised hundreds of thousands of systems globally, leveraging techniques such as SOCKS proxies, VNC sessions, and credential harvesting from various browsers and applications. The takedown highlights the effectiveness of public-private collaboration in striking at the initial stage of the cybercrime lifecycle.
