Amadey Malware Explained: How the Windows Botnet Loader and RAT Work

Key Takeaways Amadey is a resilient Windows botnet and malware loader, first seen in October 2018, and evolved into a modular RAT. Often paired with SmokeLoader, Amadey served as a dominant loader for LockBit 3.0 ransomware and state-sponsored Secret Blizzard. Amadey beacons to up to three hardcoded C2 servers over HTTP POST through a three-stage check-in, registration, and tasking lifecycle. Modern builds add a reverse TCP proxy, Hidden VNC module, admin account creation, and RDP enablement. Plugin modules steal browser, email, and FTP credentials, harvest crypto wallets, and swap clipboard wallet addresses to hijack funds. The Picus Platform lets security teams simulate Amadey attacks and validate security controls within minutes. Amadey is a resilient Windows botnet and malware loader, first seen in October 2018, that has evolved into a modular Remote Access Trojan (RAT) capable of credential theft, network pivoting, hidden remote desktop control, and clipboard hijacking.