[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$foky2dr0vCGWYgT_QgE3EqLJYK0kQmPpMHNtaGpE5vNo":3},{"article":4,"iocs":57,"watch_terms":58,"solutions":59,"lesson":79},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"dc1db003-bc37-456e-b582-62c5726926e4","Microsoft and Allies Smash Shared Infrastructure of Amadey and StealC Malware","microsoft-and-allies-smash-shared-infrastructure-of-amadey-and-stealc-malware-d6802e","Hundreds of C&C servers were disrupted in an operation involving law enforcement and several cybersecurity companies. The post Microsoft and Allies Smash Shared Infrastructure of Amadey and StealC Malware appeared first on SecurityWeek.","Microsoft, Europol, and several cybersecurity firms have collaborated to dismantle the shared command-and-control infrastructure of the Amadey and StealC malware families. This operation, part of the broader Operation Endgame, utilized AI and a vulnerability in a StealC control panel to target hundreds of domains and servers, disrupting the \"cybercrime assembly line.\" The action resulted in the seizure of over 25 million credentials and the identification of 18,000 compromised computers, with crypto assets valued at over $47 million flagged.","Microsoft and allies disrupt Amadey and StealC malware infrastructure.","https:\u002F\u002Fwww.securityweek.com\u002Fmicrosoft-and-allies-smash-shared-infrastructure-of-amadey-and-stealc-malware\u002F","https:\u002F\u002Fwww.securityweek.com\u002Fwp-content\u002Fuploads\u002F2024\u002F09\u002Fbotnet.jpeg","2026-06-24T15:02:07+00:00","2026-06-24T16:00:33.431373+00:00",8,[17,20,22,24,26,28],{"name":18,"type":19},"Microsoft","vendor",{"name":21,"type":19},"ESET",{"name":23,"type":19},"Bitsight",{"name":25,"type":19},"IBM X-Force",{"name":27,"type":19},"Proofpoint",{"name":29,"type":30},"Operation Endgame","campaign","e7b231c8-5f79-4465-8d38-1ef13aea5a14",{"id":31,"icon":33,"name":34,"slug":35},null,"Threat Intelligence","threat-intelligence",[37,42,47,52],{"category":38},{"id":39,"icon":33,"name":40,"slug":41},"02371804-cf6d-4449-98de-f1a2d4d9b266","Tools","tools",{"category":43},{"id":44,"icon":33,"name":45,"slug":46},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":48},{"id":49,"icon":33,"name":50,"slug":51},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":53},{"id":54,"icon":33,"name":55,"slug":56},"c5eccf7c-abbc-4bd3-bbed-e6da5cba8e73","Incident Response","incident-response",[],[18,21,23],{"controls":60,"vendors":61},[],[62,67,71,75],{"slug":63,"name":23,"logo_path":64,"roles":65},"bitsight","\u002Fvendor-logos\u002Fbitsight.png",[66],"reported_by",{"slug":68,"name":21,"logo_path":69,"roles":70},"eset","\u002Fvendor-logos\u002Feset.png",[66],{"slug":72,"name":18,"logo_path":73,"roles":74},"microsoft","\u002Fvendor-logos\u002Fmicrosoft.png",[66],{"slug":76,"name":27,"logo_path":77,"roles":78},"proofpoint","\u002Fvendor-logos\u002Fproofpoint.png",[66],{"slug":80,"title":81,"body":82,"framework_refs":83,"framework_notes":96},"operation-endgame-dismantles-amadey-stealc-malware-infrastructure","Operation Endgame Dismantles Amadey & StealC Malware Infrastructure","The Amadey and StealC malware campaigns thrived by leveraging shared command-and-control (C2) infrastructure, effectively creating a scalable 'cybercrime assembly line' that enabled widespread credential theft across thousands of compromised systems. A critical vulnerability in the StealC control panel was ultimately exploited by defenders to help dismantle the network — highlighting that attackers, like defenders, are also exposed to their own software flaws. The seizure of over 25 million credentials underscores how long such operations can persist undetected without robust monitoring and threat intelligence sharing. This case demonstrates the power of coordinated public-private collaboration, AI-assisted analysis, and proactive vulnerability exploitation in offensive disruption operations. Organizations that lacked visibility into C2 communications or delayed credential rotation after compromise remain at significant residual risk.",[84,85,86,87,88,89,90,91,92,93,94,95],"CIS Control 7 - Continuous Vulnerability Management","CIS Control 13 - Network Monitoring and Defense","CIS Control 17 - Incident Response Management","NIST SP 800-61 - Computer Security Incident Handling Guide","NIST IR-4 - Incident Handling","NIST SI-3 - Malicious Code Protection","NIST SI-4 - Information System Monitoring","NIST AC-2 - Account Management","MITRE ATT&CK T1071 - Application Layer Protocol (C2)","MITRE ATT&CK T1555 - Credentials from Password Stores","GDPR Article 33 - Notification of a personal data breach to the supervisory authority","GDPR Article 34 - Communication of a personal data breach to the data subject",{}]