An international public-private operation has disrupted Sality, a peer-to-peer botnet that remained active for more than two decades, by seizing domains and redirecting infected computers away from infrastructure controlled by its operator.
The coordinated action took place on August 31, 2026, and involved authorities in the United States, Bulgaria, Hungary and Romania. CrowdStrike and the Shadowserver Foundation provided technical assistance, while Europol and Eurojust supported the international coordination.
According to the US Department of Justice, the DOJ, FBI and the Defense Criminal Investigative Service seized Sality-linked domains in the United States. European authorities took action against additional domains hosted in Bulgaria, Hungary and Romania.
CrowdStrike’s Counter Adversary Operations team simultaneously carried out a peer-to-peer sinkholing operation designed to separate infected computers from the botnet’s operator.
The action disabled Sality’s current command channel, but it did not automatically remove malware from compromised computers.
Sality Remained Active for More Than Two Decades
First observed in 2003, Sality began as a polymorphic file-infecting malware family. It attached malicious code to executable files and could spread through network shares, removable drives and file-sharing systems.
Sality eventually developed into a decentralized botnet in which infected computers communicated directly with one another. Unlike a conventional botnet with one central command-and-control server, Sality’s peer-to-peer architecture did not present investigators with a single server that could be seized to disable the entire operation.
CrowdStrike said two incompatible Sality networks, known as versions 3 and 4, remained active until the disruption. Although they used the same underlying codebase and were operated by the same threat actor, the networks used different protocol versions and cryptographic keys.
The botnet’s main function was to deliver additional malicious software. During its long history, Sality distributed malware associated with credential theft, spam, proxy services, network exploitation and distributed denial-of-service attacks.
For approximately the past eight years, CrowdStrike said its primary payload was EggJagger, a clipboard-hijacking tool that monitored devices for copied cryptocurrency wallet addresses. When it detected a Bitcoin or Ethereum address, the malware replaced it with an address controlled by the attacker.
CrowdStrike estimates that at least $150,000 in cryptocurrency was stolen through EggJagger, although other malware distributed through Sality may have produced additional criminal revenue.
How Large Was the Sality Botnet?
CrowdStrike’s technical account of the disruption states that Sality enabled its operator to distribute malicious payloads to more than 33,000 infected computers worldwide at the time of the operation.
Historical figures are considerably larger. Europol reported that Sality provided access to as many as one million infected machines at its peak. More than 11 million unique IP addresses have been connected to its infrastructure over its lifetime.
The 11 million figure should not be interpreted as the number of simultaneously infected devices. Individual machines can use different IP addresses over time, and the total covers years of recorded activity.
Europol has supported Sality-related investigations since 2017. The agency said international partners held weekly operational calls in the weeks before the latest action to coordinate infrastructure seizures and the technical disruption.
How the Sinkhole Operation Worked
The operation targeted the peer lists that Sality-infected computers used to locate other machines in the botnet.
Each infected computer maintained a limited list of publicly reachable “super peers,” which formed the backbone of the P2P network. Approximately every 40 minutes, the malware checked whether those peers remained available. Responsive peers gained reputation, while unresponsive entries were gradually removed.
CrowdStrike found that the Sality protocol did not authenticate computers joining the network. Any publicly reachable system that completed the required handshake could be accepted as a legitimate peer.
Defenders used this weakness to manipulate the botnet’s peer lists. Legitimate Sality peers were invalidated and replaced with sinkhole nodes operated by CrowdStrike. As the process continued, infected computers lost contact with the criminal network and began communicating with defender-controlled infrastructure instead.
Computers located behind firewalls or network address translation could not always be contacted directly. However, when those devices initiated their routine communications with a sinkhole, their peer lists could also be purged, isolating them from the operator.
Authorities and industry partners also acted against websites hosting Sality’s payloads. Taking those locations offline prevented infected computers with older download instructions from retrieving additional malware during the transition.
Who Operated Sality?
CrowdStrike tracks the criminal actor associated with Sality as SALTY SPIDER. The company assesses that the group likely operates from Russia’s Republic of Bashkortostan, near the border with Kazakhstan.
This remains a company attribution rather than a publicly established legal finding. The DOJ and Europol announcements did not identify an individual operator, announce an arrest or disclose criminal charges connected to the disruption.
Infected Computers Still Require Remediation
Although the operator has lost the ability to issue new instructions through the disrupted network, Sality remains installed on affected computers. Additional malware previously delivered by the botnet may also remain active.
CrowdStrike said Sality-infected systems now communicate with its sinkhole infrastructure. The company published a defanged lighthouse IP address, the botnet’s final payload URLs and YARA rules that security teams can use to identify active infections.
Shadowserver is working with internet service providers and national Computer Security Incident Response Teams to identify affected organizations, notify victims and support remediation.
Organizations that detect a Sality infection should isolate the affected device, inspect it for secondary malware and remove or rebuild compromised systems. Security teams should also examine network shares and removable media that may contain infected executable files.
Passwords and other credentials used on an infected device should be considered exposed. However, credential changes should be performed from a clean system after the malware has been removed.
The operation has disabled Sality’s existing command channel and prevented it from distributing new payloads through the disrupted infrastructure. Its long-term impact will now depend on whether remaining infections are found and remediated before the operator can attempt to rebuild part of the network.
