Cops, CrowdStrike disrupt Sality botnet by poisoning the network and diverting into sinkholes
Law enforcement and CrowdStrike disrupted the 23-year-old Sality P2P botnet, isolating 15,000+ infected machines and seizing linked domains.
International law enforcement, working with CrowdStrike and the Shadowserver Foundation, executed a peer-to-peer sinkhole operation against Sality, a botnet active since 2003 that delivered malware to more than 15,000 machines worldwide. Sality's primary payload for eight years was EggJagger, a clipboard hijacker that swaps copied bitcoin and ethereum wallet addresses with attacker-controlled ones, yielding at least $150,000 in stolen cryptocurrency. The US Justice Department, FBI, and DoD Office of Inspector General's Defense Criminal Investigative Service seized Sality-linked domains, with parallel action in Bulgaria, Hungary, and Romania. The Shadowserver Foundation is coordinating with ISPs and CSIRTs to identify infections and notify victims.
- Sality has operated since 2003, distributing credential theft, spam, proxy, and DDoS payloads.
- EggJagger clipboard hijacking stole at least $150,000 in bitcoin and ethereum payments.
- The takedown poisoned bots' super-peer lists and inserted sinkhole entries to isolate infected machines.
- US DOJ, FBI, and DoD OIG seized domains; Bulgarian, Hungarian, and Romanian police acted in Europe.
- Vendors
- CrowdStrike
- Threat actors
- Sality operators
- Organizations
- CrowdStrikeShadowserver FoundationUS Justice DepartmentFBIDoD Office of Inspector General
- Countries
- United StatesBulgariaHungaryRomania
From the original article
2 min read at theregister.comInternational law enforcement agencies, working with CrowdStrike and Shadowserver Foundation, have disrupted Sality, a 23-year-old peer-to-peer botnet used to deliver malware to more than 15,000 machines worldwide.
By Jessica Lyons · theregister.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.