[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f8HyavIKNw-aZ0IME21u9RKGfW6tY89XNM3usgNcRqmE":3},{"article":4,"iocs":49,"watch_terms":50,"solutions":51,"lesson":144},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":26,"category":27,"article_tags":31},"467fd7f9-c8b8-452e-8c17-7a5bba69a11c","23-Year-Old Sality P2P Botnet Disrupted","23-year-old-sality-p2p-botnet-disrupted-6a5925","The shutdown operation involved peer list manipulation and Sality payload URL takedown. The post 23-Year-Old Sality P2P Botnet Disrupted appeared first on SecurityWeek.","An international law enforcement operation, involving CrowdStrike and multiple countries, has successfully disrupted the Sality peer-to-peer (P2P) botnet, which had been active for 23 years. The operation involved manipulating the botnet's peer list and taking down URLs hosting its payloads, effectively isolating infected machines and preventing new infections. Sality was known for distributing various malware, including the EggJagger clipjacking tool, which allegedly stole over $150,000 in cryptocurrency.","23-year-old Sality P2P botnet disrupted by international law enforcement effort.","https:\u002F\u002Fwww.securityweek.com\u002F23-year-old-sality-p2p-botnet-disrupted\u002F","https:\u002F\u002Fwww.securityweek.com\u002Fwp-content\u002Fuploads\u002F2024\u002F09\u002Fbotnet.jpeg","2026-09-02T08:38:00+00:00","2026-09-02T10:00:12.848419+00:00",8,[17,20,23],{"name":18,"type":19},"CrowdStrike","vendor",{"name":21,"type":22},"Sality P2P botnet","product",{"name":24,"type":25},"criminal behind Sality","threat_actor","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":26,"icon":28,"name":29,"slug":30},null,"Malware","malware",[32,37,39,44],{"category":33},{"id":34,"icon":28,"name":35,"slug":36},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":38},{"id":26,"icon":28,"name":29,"slug":30},{"category":40},{"id":41,"icon":28,"name":42,"slug":43},"c5eccf7c-abbc-4bd3-bbed-e6da5cba8e73","Incident Response","incident-response",{"category":45},{"id":46,"icon":28,"name":47,"slug":48},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[],[18,21],{"controls":52,"vendors":138},[53,82,111],{"slug":54,"name":55,"problem":56,"products":57},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[58,66,74],{"vendor_slug":59,"vendor_name":60,"vendor_logo":61,"product_slug":62,"product_name":63,"url":64,"description":65},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-edr","Huntress Managed EDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-edr","Endpoint detection and response monitored around the clock by Huntress analysts.",{"vendor_slug":67,"vendor_name":68,"vendor_logo":69,"product_slug":70,"product_name":71,"url":72,"description":73},"eset","ESET","\u002Fvendor-logos\u002Feset.png","eset-protect","ESET PROTECT","https:\u002F\u002Fwww.eset.com\u002Fint\u002Fbusiness\u002Fsolutions\u002Fendpoint-protection\u002F","Endpoint protection platform with detection and response add-ons.",{"vendor_slug":75,"vendor_name":76,"vendor_logo":77,"product_slug":78,"product_name":79,"url":80,"description":81},"withsecure","WithSecure","\u002Fvendor-logos\u002Fwithsecure.png","elements-xdr","WithSecure Elements XDR","https:\u002F\u002Fwww.withsecure.com\u002Fen\u002Ffor-business\u002Fplatform\u002Fxdr\u002F","Endpoint detection and response with extended detection, on the Elements cloud platform.",{"slug":83,"name":84,"problem":85,"products":86},"network-detection-response","Network detection and response (NDR)","Attackers moving between systems inside the network get seen.",[87,95,103],{"vendor_slug":88,"vendor_name":89,"vendor_logo":90,"product_slug":91,"product_name":92,"url":93,"description":94},"corelight","Corelight","\u002Fvendor-logos\u002Fcorelight.png","open-ndr","Corelight Open NDR","https:\u002F\u002Fcorelight.com\u002Fplatform\u002F","Network detection and response based on Zeek and Suricata.",{"vendor_slug":96,"vendor_name":97,"vendor_logo":98,"product_slug":99,"product_name":100,"url":101,"description":102},"darktrace","Darktrace","\u002Fvendor-logos\u002Fdarktrace.png","darktrace-network","Darktrace \u002F NETWORK","https:\u002F\u002Fwww.darktrace.com\u002Fproducts\u002Fhybrid-network","Network detection and response based on learning normal behaviour.",{"vendor_slug":104,"vendor_name":105,"vendor_logo":106,"product_slug":107,"product_name":108,"url":109,"description":110},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",{"slug":112,"name":113,"problem":114,"products":115},"dns-web-filtering","DNS filtering and secure web gateway","Users cannot reach known-malicious sites, and malware cannot phone home.",[116,124,132],{"vendor_slug":117,"vendor_name":118,"vendor_logo":119,"product_slug":120,"product_name":121,"url":122,"description":123},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","prisma-access","Prisma Access","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fsase\u002Faccess","Cloud-delivered SASE: zero trust access to private apps and secure web gateway.",{"vendor_slug":125,"vendor_name":126,"vendor_logo":127,"product_slug":128,"product_name":129,"url":130,"description":131},"zscaler","Zscaler","\u002Fvendor-logos\u002Fzscaler.png","zscaler-internet-access","Zscaler Internet Access","https:\u002F\u002Fwww.zscaler.com\u002Fproducts-and-solutions\u002Fzscaler-internet-access","Cloud secure web gateway with DNS security, inspection and data protection.",{"vendor_slug":133,"vendor_name":134,"vendor_logo":135,"product_slug":133,"product_name":134,"url":136,"description":137},"dnsfilter","DNSFilter","\u002Fvendor-logos\u002Fdnsfilter.png","https:\u002F\u002Fwww.dnsfilter.com\u002F","DNS filtering for offices and roaming devices.",[139],{"slug":140,"name":18,"logo_path":141,"roles":142},"crowdstrike","\u002Fvendor-logos\u002Fcrowdstrike.png",[143],"reported_by",{"slug":145,"title":146,"body":147,"framework_refs":148,"framework_notes":161},"23-year-old-sality-botnet-finally-disrupted-after-decades-of-malware-distribution","23-Year-Old Sality Botnet Finally Disrupted After Decades of Malware Distribution","The Sality botnet persisted for 23 years largely because infected endpoints were never identified, remediated, or isolated — a testament to how unmanaged and unmonitored systems can silently serve as malware infrastructure for decades. Sality's P2P architecture made it resilient by eliminating central command-and-control servers, meaning traditional takedown methods were insufficient and required sophisticated peer-list manipulation. The botnet's EggJagger clipjacking payload demonstrates how long-lived infections can pivot to new criminal use cases, such as cryptocurrency theft, long after initial compromise. This case underscores that organizations must continuously scan for and remediate dormant infections rather than assuming they are clean because no alerts have triggered.",[149,150,151,152,153,154,155,156,157,158,159,160],"CIS Control 1: Inventory and Control of Enterprise Assets","CIS Control 2: Inventory and Control of Software Assets","CIS Control 10: Malware Defenses","CIS Control 13: Network Monitoring and Defense","NIST SP 800-61 Rev. 2: Computer Security Incident Handling Guide","NIST SP 800-83: Guide to Malware Incident Prevention and Handling","NIST IR-4: Incident Handling","NIST SI-3: Malicious Code Protection","NIST SI-4: System Monitoring","MITRE ATT&CK T1571: Non-Standard Port (P2P C2)","MITRE ATT&CK T1025: Data from Removable Media (clipjacking variant)","ITIL: Event Management and Problem Management practices",{}]