Sality, one of the longest
US and European authorities, with CrowdStrike and Shadowserver, disrupted the 20-year-old Sality peer-to-peer botnet, severing 15,000+ infected machines from operators.
US and European authorities disrupted the Sality botnet, active since at least 2003, in an operation involving the DOJ, CrowdStrike, the Shadowserver Foundation and agencies in Bulgaria, Hungary and Romania. Researchers reverse-engineered the botnet's peer-to-peer architecture and injected false data into infected machines' 'super peer' lists, cutting more than 15,000 systems off from their operators. For the past eight years Sality primarily distributed EggJagger, malware that replaces clipboard cryptocurrency addresses and is estimated to have netted the operator at least $150,000. No arrests were announced, and CrowdStrike assesses the operator works from Russia's Bashkortostan region.
- CrowdStrike described the peer-to-peer sinkholing operation as the most complex botnet takeover it has ever performed.
- Authorities seized Sality-linked domains in the US, Bulgaria, Hungary and Romania to block payload delivery.
- EggJagger hijacked clipboard cryptocurrency wallet addresses, redirecting payments worth at least $150,000 to the attacker.
- No arrests announced; the operator, assessed to be in Russia's Bashkortostan region, remains unidentified and at large.
- Shadowserver is working with ISPs and national CERTs to identify and notify owners of infected systems.
From the original article
3 min read at therecord.media
U. S. and European authorities announced the disruption of Sality, one of the internet’s longest-running botnets, after turning the malware’s peer-to-peer architecture against itself to cut thousands of infected computers off from the suspected Russian operators controlling the network.
therecord.media
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.