In one of the most significant coordinated strikes against cybercriminal infrastructure in recent memory, law enforcement agencies across multiple jurisdictions — working in close partnership with leading private sector security firms — have successfully dismantled the operational backbone of two notorious malware families: Amadey and StealC. The operation recovered more than 27 million stolen credentials, dealing a meaningful blow to the underground economy that feeds ransomware deployment, financial fraud, and targeted attacks on critical infrastructure.
The Assembly Lines of Modern Cybercrime
Amadey and StealC are not household names outside the threat intelligence community, but their impact on the digital threat landscape has been profound. Amadey functions as a loader — a piece of malware engineered to infiltrate systems and silently deploy additional payloads, including ransomware and surveillance tools. StealC, meanwhile, is an infostealer purpose-built to harvest credentials, browser data, cryptocurrency wallets, and session tokens from infected machines.
Together, they form a lethal pairing in the cybercriminal toolkit. Amadey delivers the initial access; StealC extracts the intelligence. The stolen data is then laundered through underground markets and used to fuel follow-on attacks — everything from corporate network breaches to large-scale financial fraud schemes.
"The main common goal was to disrupt the 'assembly lines' cybercriminals use to launch ransomware, financial fraud, and attacks on critical infrastructure." — Europol
This framing is critically important. Modern cybercrime does not operate through isolated actors working in basements. It functions like an industrial supply chain — with malware-as-a-service platforms, access brokers, credential resellers, and ransomware affiliates all playing specialized roles. Taking down the infrastructure that powers these assembly lines is far more impactful than targeting individual operators.
The Role of Public-Private Collaboration
What made this operation particularly notable was the depth of coordination between law enforcement and the private sector. Firms including Bitdefender, Bitsight, ESET, and Microsoft contributed threat intelligence, technical analysis, and infrastructure mapping that enabled authorities to identify and act on critical nodes within the criminal network.
This model of collaboration is becoming the gold standard in major cybercrime disruptions. Law enforcement agencies possess legal authority and international reach; cybersecurity companies possess telemetry, reverse engineering capabilities, and adversary tracking that no government body could replicate alone. The fusion of these capabilities is what transforms an investigation into an effective takedown.
The recovery of 27 million stolen credentials is not just a headline number. Each of those credentials represents a real person or organization whose data was harvested without consent and was potentially being actively weaponized. Preventing that data from reaching buyers on dark web markets or being used in credential stuffing campaigns has tangible protective value.
Why Infostealers Deserve More Attention
The cybersecurity industry has historically devoted considerable attention to ransomware — and rightly so. But infostealers like StealC are frequently the precursor to ransomware incidents, not a separate threat category. Security teams that fail to detect an infostealer infection may find themselves dealing with a full ransomware deployment weeks later, after the harvested credentials have been used to achieve lateral movement and privilege escalation.
StealC in particular has been widely distributed through malvertising campaigns, phishing lures, and cracked software downloads. Its modular architecture allows operators to customize what it targets, making it adaptable to a wide range of criminal use cases. Amadey, similarly, has been observed being distributed through phishing emails and exploit kits, and has been used to drop a variety of second-stage payloads across different criminal campaigns.
What You Should Do
A Warning, Not a Victory Lap
Law enforcement takedowns of this scale are genuinely important and worth acknowledging. But experienced security professionals know that criminal infrastructure is resilient. Operators frequently reconstitute under new names, retool their malware, and resume operations within weeks or months of a disruption. The criminal networks that relied on Amadey and StealC will adapt.
The real value of operations like this one lies not just in the immediate disruption, but in the intelligence gathered, the relationships forged between public and private sector defenders, and the signal sent to cybercriminal communities that their infrastructure is not beyond reach. Sustained pressure, applied consistently, is what moves the needle over time.
For defenders, the lesson is clear: the threats that enable ransomware and financial fraud often arrive quietly, long before the catastrophic payload is delivered. Stopping the assembly line means detecting the loader, the stealer, and the access broker — not just the ransomware at the end of the chain.
