Sality takedown leaves infected systems requiring attention

An international operation has disrupted Sality, a peer-to-peer botnet that remained active more than two decades after it was first identified.

 

The US Justice Department worked with CrowdStrike, the FBI, European law-enforcement agencies and other partners to disconnect infected devices from the botnet operator. Sality had been used to distribute malware supporting cryptocurrency theft, spam, network exploitation and distributed denial-of-service attacks.

 

Unlike conventional botnets, Sality did not rely on a central command server that authorities could seize. Infected devices communicated directly and maintained lists of trusted peers, creating a decentralised network without a single point of failure.

 

Investigators instead turned the botnet’s design against it. According to CrowdStrike, they manipulated the peer-verification process, removed legitimate entries and inserted controlled sinkholes. Authorities also removed websites hosting additional malicious payloads.

 

The operation severed the operator’s communication with more than 33,000 infected machines, preventing new instructions and payloads from reaching them. However, the malware already installed on those devices remains active.

 

This distinction matters for enterprise defenders. A law-enforcement announcement that infrastructure has been disrupted does not mean affected endpoints are clean or that related risks have disappeared. Existing malware may retain local capabilities, while secondary payloads, stolen credentials and earlier persistence mechanisms could continue to threaten the organisation.

 

Security teams should use the published indicators to identify affected devices, inspect endpoint and network telemetry and remove confirmed infections. They should also investigate what the malware delivered or accessed before the disruption.

 

The Sality operation neutralised the criminal network’s control mechanism. Restoring trust in the individual systems it compromised remains the responsibility of their owners.