Authorities Turn Sality's P2P Network Against Itself, Cutting Off New Malware Payloads
US and European authorities with CrowdStrike dismantled the two-decade-old Sality P2P botnet using peer-list manipulation, blocking payload delivery to infected hosts.
The US Department of Justice announced a coordinated takedown of the Sality peer-to-peer botnet, executed August 31, 2026 by authorities from the US, Bulgaria, Hungary, and Romania with CrowdStrike and the Shadowserver Foundation. Sality, active since 2003, infects Windows executables and delivers payloads including the EggJagger crypto clipper, which stole at least $150,000, and was used for DDoS campaigns. The operation abused the botnet's peer-list maintenance cycle to insert sinkhole nodes and isolate both super peers and NAT-hidden infections, cutting off URL and payload distribution to more than 15,000 infected machines across two P2P networks.
- Takedown on August 31, 2026 involved US, Bulgaria, Hungary, Romania, CrowdStrike, and Shadowserver
- Peer list manipulation removed legitimate super peers and inserted sinkhole entries; technique used against GameOver Zeus and Kelihos
- EggJagger clipjack tool substituted crypto wallet addresses, netting attackers at least $150,000
- Botnet distributed payloads to 15,000+ machines via two incompatible P2P networks (versions 3 and 4)
- Sality previously targeted industrial PLCs and conducted DDoS attacks in 2016, 2022, and 2023
- Threat actors
- Salty Spider
- Organizations
- U.S. Department of Justice
From the original article
5 min read at thehackernews.com
The U. S. Department of Justice (DoJ) on Tuesday announced the takedown of a long-standing peer-to-peer (P2P) botnet known as Sality as part of a coordinated law enforcement operation.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.