International Operation Disrupts Sality P2P Botnet
US-led international operation with Europol, CrowdStrike, and Shadowserver sinkholed the 20-year-old Sality P2P botnet, once exceeding one million infected machines.
62
Malware
Sality
- Mentions · 7d0
- Mentions · 30d0
- All mentions6
- First seenSep 1, 2026
- Last mentionedSep 3, 2026
Timeline
6 articles · newest firstDogged Russia-based botnet dismantled after 23-year run
Law enforcement, CrowdStrike and Shadowserver dismantled the 23-year-old Sality P2P botnet that infected more than 11 million devices.
72
Sality, one of the longest
US and European authorities, with CrowdStrike and Shadowserver, disrupted the 20-year-old Sality peer-to-peer botnet, severing 15,000+ infected machines from operators.
52
Authorities Turn Sality's P2P Network Against Itself, Cutting Off New Malware Payloads
US and European authorities with CrowdStrike dismantled the two-decade-old Sality P2P botnet using peer-list manipulation, blocking payload delivery to infected hosts.
62
Global sinkhole operation ends Sality botnet’s 23-year run
Law enforcement, CrowdStrike, and Shadowserver sinkholed the 23-year-old Sality P2P botnet, cutting 15,000+ infected machines from its operator.
65
Cops, CrowdStrike disrupt Sality botnet by poisoning the network and diverting into sinkholes
Law enforcement and CrowdStrike disrupted the 23-year-old Sality P2P botnet, isolating 15,000+ infected machines and seizing linked domains.
72
Appears with
- CrowdStrikevendor · 6
- Shadowserver Foundationvendor · 5
- EggJaggermalware · 4
- Salityproduct · 3
- Shadowserver Foundationorganization · 3
- CrowdStrikeorganization · 3
- Europolorganization · 2
- U.S. Department of Justiceorganization · 2
- FBIorganization · 2
- US Justice Departmentorganization · 2
- US Department of Justiceorganization · 2
- Sality operatorsthreat actor · 2
- EggJaggerproduct · 2
- Salty Spiderthreat actor · 1
- Dragosvendor · 1
- Sality operatorthreat actor · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.