Amadey — Malware Profile
Amadey is a Trojan bot that has been used since at least October 2018.
MITRE ATT&CK techniques (17)
- T1005 Data from Local System
- T1016 System Network Configuration Discovery
- T1027 Obfuscated Files or Information
- T1033 System Owner/User Discovery
- T1041 Exfiltration Over C2 Channel
- T1071.001 Web Protocols
- T1082 System Information Discovery
- T1083 File and Directory Discovery
- T1105 Ingress Tool Transfer
- T1106 Native API
- T1112 Modify Registry
- T1140 Deobfuscate/Decode Files or Information
- T1518.001 Security Software Discovery
- T1547.001 Registry Run Keys / Startup Folder
- T1553.005 Mark-of-the-Web Bypass
- T1568.001 Fast Flux DNS
- T1614 System Location Discovery
IntelFusions coverage
- Microsoft and Europol disrupt the StealC and Amadey malware networks 2026-06-24
- Google and FBI disrupt NetNut proxy network of 2 million devices 2026-07-04
- Fake fix prompts spread ACR Stealer to raid corporate browser logins 2026-07-17