Amadey

Amadey is a modular malware loader and botnet ecosystem active since 2018 and commonly used as a malware distribution service. It has been advertised on darknet forums under the name InCrease and is sold in a pay-per-rebuild model in which customers operate their own self-hosted administration panels and command-and-control infrastructure. The malware’s primary role is to deliver additional payloads to compromised systems, but the platform also supports modules for credential theft, clipboard monitoring, VNC-based remote access, and other post-compromise functions. Amadey operates as a fragmented malware-as-a-service and pay-per-install ecosystem rather than a centrally managed botnet. Multiple affiliate clusters have been identified, each using distinct infrastructure and build characteristics. One especially large cluster functioned as a broad distribution service and repeatedly delivered multiple payloads per victim, including infostealers from different affiliates. Amadey has been used to distribute a wide range of commodity malware, including infostealers, remote access trojans, cryptominers, and other loaders. Observed delivery methods include fake software updates, cracked software installers, and third-party malware loaders. In active campaigns, Amadey has also been used to deploy legitimate remote management and monitoring tools as persistent backdoors by abusing normal vendor provisioning workflows rather than trojanizing the software itself. Such campaigns have shown tradecraft consistent with initial access brokerage and financially motivated intrusion activity, combining malware delivery with redundant persistence and follow-on monetization. Technical reporting describes Amadey as a modular loader that communicates with command-and-control servers over HTTP POST using RC4-encrypted traffic and a staged lifecycle for beaconing, registration, and tasking. Later versions added expanded remote access and execution features, including hidden VNC, silent installer support, remote desktop enabling, SYSTEM-level command execution, and support for encrypted payloads. Amadey has been disrupted in coordinated operations targeting affiliate infrastructure, reflecting its broad use in criminal malware distribution. Its ecosystem has also been closely tied to infostealer operations, including campaigns delivering Lumma Stealer and other credential-focused malware. Overall, Amadey is best characterized as a financially motivated criminal loader and pay-per-install service that enables initial access, malware deployment, persistence, credential theft, and broader post-exploitation activity across a globally distributed affiliate base.