GoKawiilSality botnet's 20-year P2P infrastructure seized by DOJ, FBI and CrowdStrike
U.S. and European authorities, alongside CrowdStrike's Counter Adversary Operations team, seized domains tied to the Sality botnet in the United States, Bulgaria, Hungary and Romania. CrowdStrike also ran a peer-to-peer sinkhole operation that cut off command channels and isolated infected machines from the botnet's controllers, attributed to a Russia-based group tracked as SALTY SPIDER.
GoKawiil's interpretation of the reporting above, not reported fact.
Sality has operated since 2003 and infected over 15,000 devices, evolving from spam and DDoS tools into a clipjacking operation that swaps cryptocurrency wallet addresses to steal funds. This coordinated takedown shows how public-private partnerships can dismantle long-running P2P botnets that are otherwise resilient to single points of failure, though remnants of infected machines may still need remediation.
- Sality botnet infrastructure was seized across the U.S. and three European countries.
- CrowdStrike's sinkhole operation disrupted the botnet's peer-to-peer control channels.
- The botnet's main payload, EggJagger, hijacked clipboard data to steal cryptocurrency.
Bitdefender Total Security — Botnets like Sality survive by quietly infecting everyday PCs, so a solid endpoint security suite is the practical first line of defense. Bitdefender Total Security covers multiple devices with real-time malware protection and web filtering, helping keep your machines from becoming someone else's bot.
See Bitdefender Total Security on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: bleepingcomputer.com, 2026-09-02
Published there as: “Sality botnet infrastructure dismantled in joint global takedown”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.