Amadey Equipped with AV Disabler drops Redline Stealer

**Executive Summary:** CloudSEK details an active multi-stage Amadey botnet campaign that uses chained droppers to install Healer.exe (a .NET Microsoft Defender disabler) and RedLine infostealer, resulting in permanent disabling of Microsoft Defender and Windows Update, establishment of persistence, and theft/interception of credentials and cryptocurrency; the report provides registry modifications, process/task persistence examples, IoCs (SHA256 hashes, IP addresses, URLs) and YARA rules for detection.