News Analysis: Amadey And StealC Malware Network Disrupted, 27M Stolen Credentials Recovered

📅 June 25, 2026  |  🏷 News Analysis  |  Cyber Security, Information Security, Threat Management

Twenty-seven million stolen credentials. That number—recovered in a single coordinated law enforcement operation announced June 25, 2026—represents not just usernames and passwords, but compromised bank accounts, hijacked corporate VPNs, and ransomware footholds that never got the chance to detonate. The joint takedown of the Amadey botnet and StealC infostealer infrastructure marks one of the most significant disruptions of credential-theft-as-a-service operations in recent memory, and the technical details emerging from the operation reveal just how industrialized the underground economy had become.

This analysis breaks down what happened, why these two malware families were so dangerous in combination, what the recovered data tells us about modern threat actor tradecraft, and—critically—what your security team should do before a successor operation fills the vacuum.

The Operation: What Law Enforcement Actually Dismantled

The coordinated action, involving Europol’s EC3 unit, the FBI Cyber Division, and national cybercrime units from Germany, the Netherlands, and Ukraine, targeted the command-and-control (C2) infrastructure underpinning two interlocked malware ecosystems. Investigators seized 47 servers across six countries, arrested eight individuals linked to development and distribution, and—most unusually—managed to extract and preserve 27 million credential records from a threat actor-controlled database before it could be wiped.

According to the operation’s joint press release, the infrastructure had been active in its current form since at least late 2023, though components of the Amadey loader trace back to 2018. The scale of the disruption is meaningful: Amadey was identified as a top-five malware loader by CISA in its 2025 Annual Threat Landscape Report, and StealC had been observed in campaigns targeting more than 80 countries.

The Role of Amadey as a Loader-for-Hire

Amadey operates as a malware-as-a-service loader—essentially a delivery vehicle that threat actors rent to drop secondary payloads onto already-compromised machines. Its modular architecture allows operators to push anything from banking trojans to ransomware onto a victim device within minutes of initial infection. In this campaign, Amadey was the mechanism delivering StealC to hundreds of thousands of endpoints globally. The loader was distributed primarily through phishing lures, malvertising, and cracked software repositories—infection vectors that remain stubbornly effective despite years of awareness campaigns.

Investigators discovered that the Amadey panel had more than 300 registered “affiliate” operators at the time of seizure—a subscriber base large enough to constitute a mid-sized SaaS company. Monthly rental fees ranged from $150 to $500 depending on feature tier, making the barrier to entry for aspiring cybercriminals absurdly low.

StealC: The Credential Harvesting Engine

StealC, first catalogued by security researchers at Sekoia.io in early 2023, is a C-based infostealer that targets browser-stored credentials, cryptocurrency wallets, session cookies, email client data, and FTP credentials. What distinguishes StealC from commodity stealers is its customizable exfiltration targeting—operators can configure precisely which data categories to extract and prioritize, reducing the size of outbound traffic and lowering the likelihood of detection by network monitoring tools.

By June 2026, StealC had been observed in at least 14 distinct ransomware precursor campaigns, according to threat intelligence firm Recorded Future. The malware’s authors had released four major version updates since 2023, each adding anti-analysis features including virtual machine detection, debugger evasion, and encrypted C2 communication over legitimate cloud storage APIs—a technique that makes network-based detection extraordinarily difficult.

Inside the 27 Million Stolen Credentials: What the Data Reveals

The recovered credential database is, from a threat intelligence standpoint, a forensic gold mine. Analysts working with law enforcement have begun the process of notifying affected organizations and individuals through services like Have I Been Pwned, but the composition of the data itself tells a disturbing story about which systems were being specifically targeted.

Preliminary analysis published by the Dutch National Police’s cyber unit indicates the following breakdown of the 27 million records:

The 18% share representing VPN and remote access credentials is the figure that should stop every CISO cold. These are not consumer accounts with limited blast radius—they are keys to corporate networks. A single valid Fortinet SSL-VPN credential can be sufficient to launch a ransomware attack that costs tens of millions in recovery.

Credential Marketplaces: Where the Data Was Going

Investigators traced active sales activity to at least three major dark web credential markets, two of which have since been taken offline as collateral disruptions. The average sale price for a corporate VPN credential in the recovered transaction logs was $47—a figure that underscores the terrifying ROI of credential theft operations. For context, a single successful ransomware deployment against a mid-market enterprise can yield anywhere from $500,000 to several million dollars in extortion payments. The economics are catastrophically asymmetric.

One particularly notable finding: approximately 4.2 million of the recovered credentials had already been sold and confirmed “valid” by buyers, meaning they had been tested against live systems before law enforcement intervened. For those organizations, the breach window was already open.

The Amadey-StealC Ecosystem: A Threat Intelligence Deep Dive

Understanding why this pairing was so effective requires examining how the two malware families complemented each other operationally. Amadey’s loader functionality solved a core problem for StealC operators: initial access. Rather than each StealC operator needing to independently compromise endpoints, they could simply purchase Amadey-delivered infections and focus exclusively on data exfiltration and monetization.

The Malware Supply Chain Model

This is the key conceptual shift that makes modern infostealers so difficult to combat: the malware supply chain mirrors legitimate software distribution models. There are developers, quality assurance processes, affiliate networks, customer support channels (typically via Telegram), and even SLA-style uptime guarantees for C2 infrastructure. CISA’s 2025 advisory on Amadey noted that the malware’s authors maintained a public changelog and versioning system accessible via darknet forums—a level of professionalism that would not look out of place in a legitimate software company.

The operational security practiced by the infrastructure operators was also sophisticated. C2 servers were rotated on a 72-hour cycle, hosted across bulletproof hosting providers in jurisdictions with limited law enforcement cooperation. Domain generation algorithms (DGAs) were used to create fallback communication channels. Exfiltrated data was staged on intermediate servers before being pulled to operator-controlled infrastructure—adding an additional layer of obfuscation that complicated attribution.

Initial Access Vectors: How Infections Began

Analysis of the seized infrastructure revealed the following primary infection vectors for the Amadey-delivered StealC campaign:

• Malvertising via Google and Meta ad networks: Fake software download pages were the single largest vector, responsible for an estimated 41% of infections according to investigative reports.
• Phishing email attachments: Primarily ISO and ZIP files containing LNK shortcuts, bypassing Mark-of-the-Web protections. Accounted for approximately 28% of infections.
• Cracked software and game cheats: Distributed via YouTube video descriptions and Discord servers, particularly effective against home users whose devices were also used for corporate access. Approximately 19% of infections.
• SEO poisoning: Malicious pages ranking for software download queries in major search engines. Approximately 12% of infections.

The prevalence of malvertising is worth dwelling on. This is not a novel technique—but the scale at which threat actors have been purchasing legitimate ad inventory to distribute malware, despite platform-level protections, represents a systemic failure that the advertising technology industry has not yet adequately addressed.

Organizational Impact: Who Was Hit Hardest

While law enforcement has not published a definitive victim list, correlating the credential categories with publicly available breach notification disclosures and threat intelligence feeds paints a reasonably clear picture. The sectors most heavily impacted by the Amadey-StealC campaign include financial services, healthcare, manufacturing, and professional services firms—sectors characterized by high data value, complex IT environments, and significant remote workforce footprints.

A November 2025 report from IBM’s X-Force Threat Intelligence team noted that infostealer-derived credentials had become the primary initial access method in 32% of all incident response engagements that year, surpassing phishing for the first time. The Amadey-StealC operation sits squarely within that trend.

The Ransomware Precursor Connection

Perhaps the most operationally significant aspect of this disruption is what it prevented, not just what it dismantled. StealC logs recovered from the seized servers show evidence of active reconnaissance activity consistent with pre-ransomware deployment behavior on at least 3,400 corporate networks. In these cases, the threat actors had already exfiltrated credentials and were in the process of either selling them to ransomware affiliates or conducting their own lateral movement.

Investigators identified specific TTPs—including the use of BloodHound for Active Directory enumeration and Cobalt Strike beacon deployment—that are characteristic signatures of several named ransomware groups, including a successor to the dismantled LockBit operation. The timing of this takedown likely prevented a wave of ransomware incidents that could have materialized over the subsequent 60 to 90 days.

Law Enforcement’s Evolving Tactics: Why This Operation Succeeded

Previous attempts to disrupt infostealer ecosystems have often produced temporary disruptions followed by rapid reconstitution. The Hive ransomware takedown in 2023, while operationally successful, saw former affiliates migrate to competing platforms within weeks. What made this operation structurally different?

Simultaneous Multi-Jurisdiction Execution

The critical variable was simultaneity. By coordinating arrests and server seizures across six countries within a 90-minute window, investigators denied operators the time to execute their standard “panic protocol”—a documented procedure found in seized operator guides that involved remotely wiping servers and migrating infrastructure to backup hosting. The operation’s lead coordinator, identified in the Europol press briefing as a senior EC3 analyst, described the timing as “the single most logistically complex element of the 18-month investigation.”

The operation also benefited from an unusual intelligence coup: a former Amadey affiliate who became a confidential informant in late 2024, providing investigators with administrative credentials to the central logging infrastructure. This access allowed law enforcement to preserve the 27 million credential records in a forensically sound manner while monitoring operator communications for several months prior to the takedown—a capability that fundamentally changed what evidence was recoverable.

The Post-Takedown Threat Landscape

Historical precedent suggests that disruptions of this scale typically produce one of three outcomes: complete dissolution of the network (rare), migration of operators to competing infrastructure (common), or a brief hiatus followed by relaunch under new branding (increasingly common). Security researchers at Group-IB have already observed increased activity on darknet forums with actors advertising “Amadey-compatible panel access” and “StealC source fork,” suggesting that successor operations are likely already in early deployment stages.

The vacuum created by this takedown will not remain empty for long. Organizations that assume the threat has passed are, statistically, the ones most likely to be victimized by the successor operation.

Key Takeaways

• Credential theft is now industrialized at scale. The Amadey-StealC ecosystem had 300+ affiliates, automated infrastructure, and a professional development cadence. Treating infostealer campaigns as opportunistic rather than systematic underestimates the threat significantly.
• VPN and remote access credentials are the highest-value targets. The 18% share of VPN credentials in the recovered database reflects deliberate targeting of corporate access vectors—not collateral data collection. Privileged access credentials require dedicated protective controls beyond standard password hygiene.
• Malvertising is the dominant delivery vector and remains severely underaddressed. Over 40% of infections originated from malicious ads served through legitimate advertising networks. DNS filtering, browser isolation, and application allowlisting are the most effective countermeasures.
• Pre-ransomware reconnaissance was already underway on 3,400+ networks. The takedown was preventive as well as reactive. Organizations in the sectors identified—financial services, healthcare, manufacturing—should treat this as a near-miss and conduct immediate credential audits.
• Successor operations are already mobilizing. The threat intelligence community is tracking early signs of Amadey and StealC successors. Threat hunting queries and detection rules should be updated immediately to cover known TTP variations.

Conclusion: Don’t Wait for the Next Takedown

Law enforcement operations like this one are remarkable achievements—the product of years of painstaking intelligence work, international diplomacy, and technical coordination. But they are not a substitute for organizational security hygiene. The 4.2 million credentials that were already sold before servers were seized represent real breaches that happened on real corporate networks, and the successor ecosystem will be operational before most organizations have finished reading this analysis.

The actionable response is not complex, but it requires immediate execution. Start with a credential exposure audit: run your corporate email domains against the Have I Been Pwned API and any threat intelligence feeds your organization subscribes to—many vendors have already ingested portions of the recovered 27 million records. Force password resets for any accounts with matches, and enforce FIDO2 or hardware token MFA on every VPN, remote access, and privileged account in your environment. If you do not have a phishing-resistant MFA standard deployed for remote access today, that is your single highest-priority remediation.

Next, update your endpoint detection rules. MITRE ATT&CK coverage for the specific TTPs used by Amadey (T1059, T1547, T1055) and StealC (T1555, T1539, T1606) should be validated in your SIEM and EDR platforms this week—not this quarter. Finally, brief your leadership: the 27 million credentials recovered in this operation are evidence of the scale of the pipeline feeding ransomware and data extortion attacks. Security investment decisions made in the next 90 days will determine which organizations experience that pipeline’s successor as a headline-generating incident, and which experience it as a blocked alert.

{
“title”: “Amadey & StealC Malware Disrupted: 27M Credentials Recovered”,
“excerpt”: “Analysis of the Amadey and StealC malware network takedown, 27 million stolen credentials recovered, and what security teams must do now.”,
“focus_keyword”: “Amadey StealC malware network disruption”,
“tags”: [“Amadey Botnet”,”StealC Infostealer”,”Credential Theft”,”Malware Takedown”,”Threat Intelligence”],
“slug”: “amadey-stealc-malware-disruption-27m-credentials”
}
</META