Sality botnet dismantled in global takedown after two-decade run of infections

Authorities in the United States and three European countries disrupted the Sality botnet this week, ending more than two decades of continuous operation by one of the internet’s oldest malware networks. The joint action, carried out Monday, involved U.S. federal agencies, Bulgarian, Hungarian and Romanian authorities, cybersecurity firm CrowdStrike and the nonprofit Shadowserver Foundation.

The U.S. Department of Justice, FBI and Defense Criminal Investigative Service seized Sality-linked domains inside the United States, while their counterparts in Bulgaria, Hungary and Romania seized additional domains hosted across Europe. Those domains had served as fallback infrastructure that infected systems could have used to fetch new malicious payloads even after the botnet’s core communication network was severed.

That core network posed a distinct technical challenge. Rather than relying on a central command server, Sality-infected machines communicated directly with one another in a decentralized, peer-to-peer structure, meaning there was no single point investigators could redirect to shut the system down. CrowdStrike researcher Tillmann Werner described the effort required to defeat that design as the most complex botnet takeover the company has carried out, according to remarks he gave to Reuters.

CrowdStrike’s Counter Adversary Operations team examined the "super peer" lists that each infected computer maintains to relay information across the network. By feeding false entries into those lists, the company severed communication between more than 15,000 infected machines and the network’s operator, leaving the isolated computers unable to receive further commands or download additional malware.

CrowdStrike attributes the botnet to a criminal group it calls SALTY SPIDER, which it believes operates out of the Bashkortostan region of Russia. No arrests have been announced, and the identity of the operator has not been made public.

Sality first appeared in 2003 as a file-infecting virus that spread when compromised executable files were transferred between computers. Over time it evolved into a peer-to-peer botnet used to distribute a range of malicious tools tied to credential theft, spam distribution, proxy services, network intrusion and denial-of-service attacks.

For roughly the past eight years, the network’s primary payload has been EggJagger, a program that watches an infected computer’s clipboard for copied cryptocurrency wallet addresses and quietly swaps them for addresses controlled by the attacker, diverting funds if the victim does not catch the substitution before completing a transaction. CrowdStrike estimates the scheme netted the operator at least $150,000 in cryptocurrency, enough to sustain a single actor running the operation with little overhead, though the firm noted other payloads distributed over the botnet’s history may have generated additional income.

Shadowserver is now working with internet service providers and national cybersecurity response teams to identify the more than 15,000 systems that remained connected to Sality at the time of the takedown and to notify their owners. David Watson, a director at Shadowserver, told Reuters the botnet was "quite old-school" but remained a genuine threat because compromised machines could still give attackers a foothold inside victim organizations.