Global sinkhole operation ends Sality botnet’s 23-year run
Law enforcement, CrowdStrike, and Shadowserver sinkholed the 23-year-old Sality P2P botnet, cutting 15,000+ infected machines from its operator.
Sality, active since 2003 as a file-infecting virus with two P2P networks (versions 3 and 4), distributed credential thieves, spam, proxies, and DDoS payloads, and most recently delivered the EggJagger clipboard hijacker that swapped cryptocurrency wallet addresses for at least $150,000 in operator profit. A coordinated sinkhole operation replaced the botnet's super-peer list with defender-controlled sinkholes, and investigators in the US, Bulgaria, Hungary, and Romania seized payload domains. The Shadowserver Foundation is coordinating ISP and CERT notifications to infected device owners.
- Operation invalidated legitimate super peers, isolating bots from the operator permanently.
- EggJagger clipboard hijacker redirected Bitcoin and Ethereum payments for ~$150,000+.
- Sality launched three DDoS campaigns, including one against a Ukrainian forum in February 2022.
- Domains hosting payload files were seized in four countries; ISPs and CERTs now notify victims.
- Products
- Sality
- Threat actors
- Sality operator
From the original article
3 min read at helpnetsecurity.com
Sality, a peer-to-peer (P2P) botnet that had been running for 23 years and infecting more than 15,000 machines worldwide, has been taken down in a joint operation by international law enforcement agencies, working with CrowdStrike and the Shadowserver Foundation. The operation cut Sality’s operator off from every infected machine still under their control.
By @helpnetsecurity · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.