SUBJECT PROFILE
As part of the ongoing Operation Endgame Phase 4 (June 2026), Europol and partners from six countries disrupted the Amadey and StealC malware-as-a-service networks, seizing 326 servers, freezing $47M in criminal cryptocurrency, and recovering 27 million stolen login credentials from 385,000 compromised systems. Microsoft's Digital Crimes Unit filed a RICO civil lawsuit after AI-assisted analysis (using Microsoft Copilot) revealed Amadey and StealC shared the same C2 infrastructure despite being developed by separate criminal groups, enabling a unified takedown of 200+ C2 servers. In May 2026 alone, the two infostealers were linked to 140,000 infected computers.
Financially motivated infostealer-as-a-service operations providing credential theft infrastructure to downstream cybercriminal actors including ransomware affiliates
OPERATIONAL HISTORY
Infostealer-as-a-service distribution (T1566), malvertising delivery, SocGholish fake browser update dropper (T1189), credential harvesting (T1555), C2 communication via shared infrastructure (T1571), botnet-as-a-service, ransomware pre-positioning
KNOWN INFRASTRUCTURE
200+ C2 servers (seized/disrupted June 2026 via Microsoft civil action + Europol), SocGholish distribution network (1.44M compromised WordPress sites as of May 2026), shared Amadey/StealC command-and-control backend infrastructure; Evil Corp organizational links