Law Enforcement and Microsoft Tear Down Command Infrastructure Behind Amadey and StealC

Hundreds of command-and-control servers are offline. That's the headline — but the more interesting story is what it says about how modern malware operations share plumbing.

Microsoft and a coalition of law enforcement agencies and cybersecurity firms executed a coordinated disruption targeting infrastructure used by both Amadey and StealC, two infostealer families that have been persistent fixtures in the crimeware ecosystem. The operation focused on C2 servers — the endpoints malware phones home to for tasking and exfiltration — rather than the malware authors themselves.

Amadey is a loader and credential harvester that's been in circulation since at least 2018. StealC, the younger of the two, emerged more recently and quickly became a go-to tool for session cookie theft and credential scraping. The fact that both families relied on overlapping infrastructure isn't a coincidence. The underground economy increasingly runs on infrastructure-as-a-service: bulletproof hosting, shared C2 panels, and resold access that lets different threat actors spin up campaigns without managing servers themselves.

Taking down that shared layer matters more than it might look on paper. If you disrupt one actor's C2, you interrupt one campaign. If you disrupt the shared backbone, you potentially interrupt dozens simultaneously.

From an identity angle, both Amadey and StealC specifically target authentication material. Saved browser credentials, session cookies, OIDC tokens cached locally — this is their harvest. Notably, neither family needs your password if they can grab a valid session token post-authentication. MFA doesn't help once a session is already established; what matters is session lifetime, binding, and revocation. Short-lived tokens with strict audience (aud) claims and back-channel logout support (as specified in OpenID Connect's back-channel logout spec) would meaningfully limit the blast radius of a successful steal.

The operation disrupted hundreds of servers. Vendors involved have not, as of publication, released detailed technical advisories enumerating specific IOCs or affected IP ranges — those would be worth watching for.

Infrastructure takedowns are temporary pressure, not permanent eradication. Threat actors rebuild. New bulletproof hosts appear. But disruptions like this do impose real cost and operational delay, and when they target shared infrastructure, the disruption is disproportionate to the effort. That's the calculus worth repeating.