42
42
42
42
42
42
42
42
57
42
42
42
42
42
42
47
42
Dogged Russia-based botnet dismantled after 23-year run
Law enforcement, CrowdStrike and Shadowserver dismantled the 23-year-old Sality P2P botnet that infected more than 11 million devices.
Sality, a Russia-based peer-to-peer botnet active for 23 years and infecting over 11 million devices, was dismantled by law enforcement working with CrowdStrike and the Shadowserver Foundation. CrowdStrike poisoned the botnet's peer list so infected machines permanently disappeared from the operator's view, while domains were seized in a coordinated effort involving the FBI, Justice Department, Europol and authorities from Bulgaria, Hungary and Romania. The financially motivated operation enabled cryptocurrency theft, DDoS attacks and other cyberattacks, and Europol said the effort dates back to 2017; the operators were not named.
72
Global sinkhole operation ends Sality botnet’s 23-year run
Law enforcement, CrowdStrike, and Shadowserver sinkholed the 23-year-old Sality P2P botnet, cutting 15,000+ infected machines from its operator.
Sality, active since 2003 as a file-infecting virus with two P2P networks (versions 3 and 4), distributed credential thieves, spam, proxies, and DDoS payloads, and most recently delivered the EggJagger clipboard hijacker that swapped cryptocurrency wallet addresses for at least $150,000 in operator profit. A coordinated sinkhole operation replaced the botnet's super-peer list with defender-controlled sinkholes, and investigators in the US, Bulgaria, Hungary, and Romania seized payload domains. The Shadowserver Foundation is coordinating ISP and CERT notifications to infected device owners.
65
42
42
42
42
42
42
42
42
42
42
42
42
42
42
57
42
42
42
42
42
42