An international coalition of law-enforcement agencies and cybersecurity organisations has disrupted Sality, one of the internet’s longest-running botnets, following a coordinated operation spanning the United States, Bulgaria, Hungary and Romania.
The operation combined court-authorised domain seizures with a technically complex effort to infiltrate and redirect Sality’s decentralised peer-to-peer communications. The intervention was designed to isolate infected computers from the botnet operator, prevent the delivery of additional malware and give network defenders the information needed to identify affected systems.
Sality has operated in various forms since 2003. What began as a Windows file-infecting virus gradually developed into a resilient malware-distribution platform capable of spreading additional payloads, stealing cryptocurrency, supporting spam and proxy operations, and conducting distributed denial-of-service attacks.
CrowdStrike said the network remained capable of distributing malicious software to more than 15,000 infected machines worldwide immediately before the disruption. Although modest compared with some botnets that have infected hundreds of thousands or millions of devices, Sality’s endurance, self-propagation capabilities and absence of a conventional central command server made it unusually difficult to dismantle.
The multinational action involved the US Department of Justice, FBI and Defense Criminal Investigative Service, alongside CrowdStrike and the nonprofit Shadowserver Foundation. Europol, Eurojust and national authorities in Bulgaria, Hungary and Romania supported the European component of the operation.
US authorities seized domains linked to Sality, while their European counterparts acted against additional domains hosted in their jurisdictions. CrowdStrike simultaneously conducted a peer-to-peer sinkholing operation intended to sever communication between compromised computers and the person controlling them.
The Shadowserver Foundation is now using information collected through the sinkhole to help internet service providers and national computer security incident response teams identify infections, notify affected organisations and support remediation, according to the US Justice Department.
Sality’s decentralised network turned against it
Traditional botnets generally depend on a collection of central command-and-control servers. Infected machines periodically connect to those servers for instructions, malware updates or new payloads. When investigators seize or disable the servers and associated domains, they can often interrupt the entire criminal operation.
Sality was designed to be considerably more resistant to that approach.
Its infected machines communicated directly with one another through a peer-to-peer network. Each participating device maintained information about other infected systems and could help circulate commands and updates. Removing one server or seizing a handful of domains would not necessarily stop the network because there was no single command centre whose loss would disable every bot.
CrowdStrike said two independent Sality networks, known as versions 3 and 4, remained operational before the takedown. The networks shared the same underlying code and were allegedly controlled by the same operator, but used incompatible communication protocols and separate cryptographic keys.
Researchers had to analyse both networks, understand how infected systems selected and trusted other peers, and identify weaknesses that could be used to redirect their communications without allowing the operator to regain control.
The disruption ultimately exploited Sality’s own peer-management mechanisms. CrowdStrike introduced specially constructed information into the network that caused infected devices to reject or isolate the peers used by the operator. The compromised machines were then steered towards infrastructure controlled by the disruption team.
The effect was to make Sality’s command channel inert Infected computers could communicate with the sinkhole but could no longer receive new criminal instructions or secondary malware from the original operator
Tillmann Werner, a CrowdStrike researcher involved in the effort, described it as the company’s most complicated botnet takeover to date. He told Reuters that the architecture had been deliberately engineered to withstand attempted seizures and hostile takeovers, helping explain its survival for more than 20 years.
The operation began on August 31, with CrowdStrike carrying out the technical disruption during its Day Zero threat-intelligence summit in Las Vegas. Government announcements and technical details were released the following day.
More than a conventional botnet
Sality is not simply a remote-access Trojan installed as a standalone program. It is a polymorphic file infector that embeds malicious code inside legitimate Windows executables, particularly .exe and .scr files.
Polymorphism allows the malware to alter parts of its code or appearance each time it infects a new file. Although the underlying behaviour remains similar, the resulting files do not necessarily have identical signatures, complicating detection by security products that depend heavily on static pattern matching.
Once established on a computer, Sality can infect additional executable files and spread through local storage, network shares, removable drives and shared files. This gave the botnet a self-sustaining propagation mechanism: new infections could continue to appear even when the operator was not running an active phishing campaign or exploit operation.
CrowdStrike said this regenerative quality was one of the two principal reasons for Sality’s longevity, alongside its decentralised command architecture. Infected executable files could remain stored on old systems, file servers, removable media or poorly maintained networks, creating opportunities for reinfection long after an initial outbreak appeared to have been resolved.
Microsoft’s historical analysis describes Sality as capable of terminating antivirus and firewall processes, deleting security-related files, weakening Windows security settings and downloading additional executables. Some variants have also been able to steal cached passwords and record keystrokes. The malware can modify firewall and User Account Control settings to facilitate its activity and make affected computers harder to defend, according toMicrosoft Security Intelligence.
This combination of file infection, defensive evasion and payload delivery made Sality valuable as a general-purpose foothold. The core malware did not need to contain every criminal function itself. Its primary role was to keep infected systems connected and give the operator a dependable way to distribute other malware.
Over its lifetime, the network has delivered payloads associated with credential theft, spam, traffic proxying, network exploitation and denial-of-service attacks. A compromised Sality endpoint could therefore expose an organisation to risks far beyond the original infection.
Cryptocurrency theft became a central revenue source
Sality’s monetisation strategy changed as the cybercrime economy evolved.
Earlier operations included spam distribution and proxy services, but CrowdStrike reported that the operator shifted increasingly towards cryptocurrency-related activity from approximately 2017. For the past eight years, the botnet’s main secondary payload was reportedly a clipboard hijacker called EggJagger.
Clipboard hijacking, sometimes called clipjacking, exploits the way people commonly make cryptocurrency payments. Wallet addresses are long and difficult to type manually, so users usually copy and paste them. EggJagger monitored the Windows clipboard for text resembling a Bitcoin or Ethereum address and replaced it with an address controlled by the attacker.
If the victim failed to verify the complete address before approving a transfer, the payment went to the criminal rather than its intended recipient. Blockchain transactions generally cannot be reversed once confirmed, making this a comparatively simple but effective theft technique.
CrowdStrike traced at least 12.1 million Russian rubles—approximately $150,000 at the cited exchange rate—in stolen cryptocurrency to the EggJagger operation. The company said the value of the unspent cryptocurrency portfolio reached approximately 147 million rubles at its January 2025 peak.
Those figures cover only wallets and transactions attributed to EggJagger. They do not include possible revenue from other Sality payloads, rented access, proxy services, spam or earlier criminal campaigns. The total financial damage caused over the botnet’s two-decade lifetime could therefore be substantially higher.
The model also required relatively little continuing effort. Once the peer-to-peer network and file-infection mechanism were established, the operator could maintain access to thousands of machines and periodically deliver revenue-generating payloads without building a new intrusion infrastructure for each campaign.
Botnet also used for denial-of-service attacks
Financial crime appears to have been Sality’s main purpose, but investigators found evidence that its operator occasionally used the botnet for targeted denial-of-service attacks.
CrowdStrike identified three notable campaigns. One attack in April 2016 targeted Forex2030, an Arabic-language financial forum, and successfully made the site unavailable. The motive was not established.
A second operation occurred on February 25, 2022, one day after Russia launched its full-scale invasion of Ukraine. Sality distributed a denial-of-service payload targeting Kharkovforum, a Ukrainian discussion forum where users were sharing information about events in and around Kharkiv.
The timing raises the possibility of a political motive, although CrowdStrike did not claim to have conclusively established why the site was selected. The campaign demonstrated that infrastructure primarily maintained for financial crime could be redirected quickly towards a target connected to a major geopolitical event.
A third attack targeted an online cryptocurrency exchange. CrowdStrike said the denial-of-service payload was compiled shortly before being uploaded to Sality’s distribution infrastructure, indicating that the operator could build and deploy specialised attack tools at short notice.
These incidents underline the wider security risk posed by long-lived botnets. Even when their everyday activity appears limited to relatively low-level fraud, thousands of compromised computers can be repurposed rapidly for disruption, malware delivery or attacks against new targets.
Attribution and the unanswered enforcement question
CrowdStrike tracks the operator associated with Sality under the name SALTY SPIDER and has previously assessed that the activity likely originated in Russia, potentially in the Republic of Bashkortostan. The company linked the botnet’s growth in 2017 partly to the exploitation of EternalBlue, the Windows Server Message Block vulnerability also used by WannaCry and NotPetya.
The Justice Department described Sality as a Russia-based operation but the public announcement did not name an alleged operator or disclose any arrests, criminal charges or extradition proceedings
That distinction is important. The operation disrupted infrastructure and deprived the controller of immediate access to the known botnet, but it did not necessarily remove the person behind it from the cybercrime ecosystem.
The operator could attempt to rebuild the network, create a new protocol, distribute an updated malware version or migrate to an entirely different platform. Any such recovery would require time and resources, however, and would not automatically restore access to the machines redirected into the sinkhole.
Monitoring the network after the disruption will therefore be critical. Investigators will be looking for attempts to issue alternative instructions, reactivate dormant infrastructure or distribute replacement malware through infections and channels not covered by the operation.
Disruption does not disinfect affected computers
The sinkhole prevents known infected machines from receiving new commands through the disrupted Sality networks, but it does not automatically remove the malicious code from those computers.
Every device that contacts the sinkhole must still be treated as compromised. The underlying Sality infection may remain embedded in executable files, while additional malware previously installed through the botnet may continue operating independently.
A computer could therefore be disconnected from Sality’s operator yet still contain credential stealers, clipboard hijackers, backdoors or other malicious components. Stolen passwords and authentication tokens also remain exposed even after the malware has been removed.
Because Sality modifies legitimate files, remediation can be more complicated than deleting a single malicious executable. Organisations may need to isolate affected endpoints, preserve evidence, conduct a full forensic examination and rebuild heavily infected systems from trusted media. Restoring executable files from unverified backups could reintroduce the malware.
Defenders should also investigate connected file shares, removable media and other endpoints that may have exchanged executable files with the infected device. Failure to find those secondary infection sources could allow Sality to return after an apparently successful cleanup.
Passwords and other credentials used on affected computers should be changed from a clean device after remediation. Cryptocurrency users should review historic transfers, verify destination addresses through an independent channel and assume that clipboard contents may have been manipulated while the system was infected.
Network defenders can use endpoint detection telemetry, antivirus detections, unusual peer-to-peer traffic and information provided through Shadowserver, national CSIRTs or internet service providers to identify potentially affected systems.
A significant setback, but not necessarily Sality’s final chapter
The operation represents a major technical and operational defeat for a malware network that survived repeated changes in the threat landscape, from the era of mass-mailing viruses to modern cryptocurrency theft.
Its success depended on actions that no single participant could have carried out alone. CrowdStrike supplied the reverse engineering and peer-to-peer intervention, US and European authorities provided the legal powers needed to seize infrastructure across several jurisdictions, and Shadowserver is converting the resulting sinkhole data into notifications that can help victims remove persistent infections.
The Sality takedown also illustrates the growing emphasis on sustained cyber disruption rather than relying exclusively on arrests. Operators based in jurisdictions that do not cooperate with Western extradition requests may remain beyond the immediate reach of law enforcement, but their infrastructure, revenue channels and access to compromised machines can still be targeted.
Nevertheless, calling the botnet completely eradicated would be premature. Its decentralised architecture has been neutralised, not physically removed from every victim machine, and no publicly identified suspect has been detained.
The immediate result is that the known Sality controller has lost the ability to send new instructions through the two disrupted peer-to-peer networks. The longer-term outcome will depend on whether infected systems are cleaned, whether remaining propagation sources are eliminated and whether the operator can find a way to rebuild.
For organisations receiving Sality notifications in the coming weeks, the message is straightforward: the criminal command channel may have been severed, but the presence of the malware is evidence of a wider system compromise that still demands a full incident response.
