30
30
30
30
30
30
30
30
30
42
Zyxel adds enhancements and two new firewalls to its USG FLEX family of mid-range firewalls for SMBs
30
30
30
55
60
42
42
55
30
42
30
42
42
30
55
30
30
30
42
30
International Operation Disrupts Sality P2P Botnet
US-led international operation with Europol, CrowdStrike, and Shadowserver sinkholed the 20-year-old Sality P2P botnet, once exceeding one million infected machines.
On August 31, 2026, authorities from the US, Bulgaria, Hungary, and Romania, supported by Europol, CrowdStrike, and the Shadowserver Foundation, disrupted the Sality P2P botnet by sinkholing communications and seizing domains. Sality has operated for over 20 years, at its peak controlling more than one million infected machines used for credential theft, spam, proxy services, crypto-theft, and DDoS attacks, with over 11 million unique IP addresses linked to its infrastructure since 2017. The disruption exploited the botnet's super-peer reputation mechanism by removing legitimate peers via protocol-level manipulation and inserting sinkhole entries into emptied peer lists.
62
Authorities Turn Sality's P2P Network Against Itself, Cutting Off New Malware Payloads
US and European authorities with CrowdStrike dismantled the two-decade-old Sality P2P botnet using peer-list manipulation, blocking payload delivery to infected hosts.
The US Department of Justice announced a coordinated takedown of the Sality peer-to-peer botnet, executed August 31, 2026 by authorities from the US, Bulgaria, Hungary, and Romania with CrowdStrike and the Shadowserver Foundation. Sality, active since 2003, infects Windows executables and delivers payloads including the EggJagger crypto clipper, which stole at least $150,000, and was used for DDoS campaigns. The operation abused the botnet's peer-list maintenance cycle to insert sinkhole nodes and isolate both super peers and NAT-hidden infections, cutting off URL and payload distribution to more than 15,000 infected machines across two P2P networks.
62
ValleyRAT Backdoor Hides in Signed Adware That Users Add to Antivirus Exclusions
Silver Fox distributes ValleyRAT via signed QN Wallpaper adware, sideloading a malicious libcef.dll into a trusted process to evade defenses.
Kaspersky reports the Silver Fox threat actor disguising the ValleyRAT backdoor (Winos 4.0) inside a modified, signed copy of the QN Wallpaper adware tool, using DLL sideloading to run within a trusted process. The installer disables Windows Defender via the DisableAntiSpyware registry key, adds autorun entries, and elevates via runas when needed; ValleyRAT steals keystrokes, clipboard data, and screenshots and can mark its process critical to trigger BSOD if killed. Kaspersky recorded more than 100,000 ValleyRAT detections affecting over 1,500 unique users in 2026, mostly in China and India, with prior campaigns against Japan, India, and Russia.
62
42
55
30
30
30
42
55