APT / THREAT GROUP

Amadey

2
aliases
Last seen:Mar 17, 2026

Intelligence Profile

Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.

Threat Analysis

Amadey is a known-sophistication threat actor of undetermined national origin, engaged in cyber operations with a primary motivation of unknown activity patterns.

Intelligence Reports Mentioning Amadey

External References

Quick Facts

TypeAPT / Threat Group
Aliases2

Also Known As

Amadeywin.amadey

External Intelligence

Malpedia: win.amadey

Research Links

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.