Microsoft and law enforcement disrupt Amadey and StealC infrastructure
THE BRIEF
Microsoft, Europol and international partners disrupted infrastructure used by the Amadey and StealC malware ecosystems. The action affected hundreds of servers and domains, identified tens of millions of stolen credentials and increased friction for criminal operators that provide access or data to wider ransomware and fraud networks.
WHY IT MATTERS
Takedowns matter because malware loaders and credential stealers are upstream suppliers to many other forms of cybercrime. Disrupting shared infrastructure can reduce the volume of later ransomware, account takeover and fraud activity.
WHO SHOULD CARE
Threat-intelligence teams, fraud teams and incident responders.
WHAT TO DO NOW
- Check whether stolen credentials affect your users
- Reset exposed credentials
- Monitor for replacement infrastructure
VERIFICATION NOTE
Backfilled historical brief from a named primary or established reporting source.
