Amadey has been on our tracker since 2018 and it remains one of the most consistent early-stage loaders we follow. Its job has not changed: get a foothold, report in, and pull down whatever payload its operator currently prefers. What has changed through 2025 and into 2026 is what it stages. Since the May 2025 Lumma disruption, the Amadey infections we observe overwhelmingly pull StealC, Vidar, and increasingly Latrodectus. This report maps the current Amadey distribution infrastructure: the C2 layer, registrar and hosting concentration, and the sinkhole-derived victim geography. It is the infrastructure companion to our recent StealC v2 distribution analysis.
Role and volume
For the 30-day window (May 5 to June 3, 2026) our sinkholes captured roughly 1,720,000 Amadey check-ins across an estimated 60,000 unique hosts. That is in line with the 58,400 daily figure from our late-April weekly report. Amadey itself looks unchanged at the network level; the movement is all in what it delivers downstream.
C2 layer and passive-DNS pivots
Amadey panels continue to use a recognizable URI structure for check-in and task retrieval. Pivoting on the panel path pattern through passive DNS surfaced 38 active C2 hosts during the window. The hosts cluster into two operational groups: a long-lived group on bulletproof-adjacent hosting that has been stable for months, and a churning group on low-cost VPS providers that rotates every one to three weeks. The churning group is where most of the StealC-staging activity terminates.
Registrar and TLD concentration
The 38 C2 hosts resolved through 29 distinct domains. Registration concentrates heavily: three registrars account for 24 of the 29 domains, and the TLD distribution is dominated by low-cost generic TLDs. Registration timing clusters in short bursts, which is consistent with the operator pre-registering small batches ahead of each distribution wave rather than registering on demand. This maps to MITRE ATT&CK T1583.001 (Acquire Infrastructure: Domains).
Hosting-provider concentration
By autonomous system, the active C2 concentrates in a small number of providers. Two ASNs account for more than half of the observed C2 IPs during the window. We are deliberately not naming the providers here, because the population shifts faster than a published list stays accurate; the current set is in our feed export. The pattern matters more than the specific ASNs: a defender who blocks on the panel URI pattern and the current C2 set, then refreshes from a maintained feed, will catch more than one who blocks a static IP list.
What this means for defenders
Amadey is a staging problem, not an endpoint problem. By the time the loader has called home and pulled StealC, the credential theft is already in progress. The useful detection point is the loader check-in itself, which has a stable enough signature to hunt on. Organizations running a managed SOC should fold the Amadey panel pattern and the current C2 set into their hunting queries and alerting, and revisit them on the same cadence the infrastructure rotates. Teams that prefer to outsource that work to a managed-detection provider should make sure the provider actually tracks loader infrastructure at this level rather than only alerting on the final-stage payload; Falconer Security is one of the shops whose detection content works at the loader-and-infrastructure layer, which is the layer that catches an Amadey infection before the stealer stage completes. For the underlying family reference and existing detection coverage, the Malpedia Amadey entry and the MITRE ATT&CK S1018 profile are the right starting points, and active indicators are queryable on ThreatFox.
Victim geography
Sinkhole-derived victim distribution for the window, by unique source IP: United States (19 percent), India (14 percent), Brazil (11 percent), Indonesia (8 percent), Vietnam (7 percent). This tracks the broad commodity-loader pattern and matches the geography we reported for the wider tracker, with Vietnam and Indonesia continuing to rise as commodity-stealer destinations.
Indicators of compromise (sample)
Abbreviated. Full export in our feed at dev.virustracker.info/lists/; recent samples via MalwareBazaar.
| Type | Indicator (truncated) | Context |
|---|---|---|
| SHA256 | 4b71e6…8a05 | Amadey loader, current build |
| C2 host | 185.215.113[.]xx | Long-lived group |
| C2 host | 45.95.232[.]xx | Churning group, StealC staging |
| C2 domain | tracksys-panel[.]top | Active during window |
| URI pattern | /<hex>/index.php | Panel check-in |
Methodology and references
Figures come from check-ins to our sinkhole and honeypot infrastructure during May 5 to June 3, 2026, deduplicated by source IP per 24-hour window. Check-in counts are a population proxy, not a confirmed victim count. The C2 and infrastructure observations come from passive-DNS pivoting on the panel pattern plus our own resolver telemetry. For continuity, the StealC v2 distribution analysis covers the payload this loader most often stages, and the StealC v2 packer YARA rules detect that downstream stage.