Dogged Russia-based botnet dismantled after 23-year run
Law enforcement, CrowdStrike and Shadowserver dismantled the 23-year-old Sality P2P botnet that infected more than 11 million devices.
Sality, a Russia-based peer-to-peer botnet active for 23 years and infecting over 11 million devices, was dismantled by law enforcement working with CrowdStrike and the Shadowserver Foundation. CrowdStrike poisoned the botnet's peer list so infected machines permanently disappeared from the operator's view, while domains were seized in a coordinated effort involving the FBI, Justice Department, Europol and authorities from Bulgaria, Hungary and Romania. The financially motivated operation enabled cryptocurrency theft, DDoS attacks and other cyberattacks, and Europol said the effort dates back to 2017; the operators were not named.
- Decentralized P2P architecture let Sality evade disruption for over two decades
- CrowdStrike tricked the network into severing infected peers, making the botnet irrecoverable
- Shadowserver is working with ISPs to identify and remediate infected devices
- Attributed three DDoS attacks to the botnet alongside its criminal use
- Threat actors
- Sality operators
- Malware
- Sality
- Organizations
- FBIUS Department of JusticeEuropol
- Countries
- United StatesBulgariaHungaryRomania
From the original article
3 min read at cyberscoop.com
Sality’s peer-to-peer infrastructure allowed it to evade system-wide disruption efforts for an exceptionally long period. Authorities and cybersecurity experts finally brought it down. The post Dogged Russia-based botnet dismantled after 23-year run appeared first on CyberScoop.
By Matt Kapko · cyberscoop.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.