Authorities Turn Sality's P2P Network Against Itself, Cutting Off New Malware Payloads
Authorities dismantled the Sality P2P botnet, disrupting malware distribution.
A coordinated law enforcement operation involving the U.S. DoJ, Bulgaria, Hungary, and Romania, alongside CrowdStrike and Shadowserver Foundation, has successfully taken down the Sality peer-to-peer botnet. The operation utilized a sinkhole strategy to sever communication and seize Sality-linked domains, effectively neutralizing the malware's ability to distribute new payloads and infect machines worldwide. Sality, active since 2003, has been responsible for delivering various malicious software, including the cryptocurrency clipper EggJagger, and has been repurposed for DDoS attacks.
AI summary of the linked source. Not reviewed by an editor. How this works
Run CrowdStrike?
Get an email when a new story names CrowdStrike, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe Sality botnet, active since 2003, persisted for over two decades largely because infected endpoints lacked adequate monitoring and isolation controls, allowing peer-to-peer command-and-control traffic to go undetected. Authorities ultimately had to turn the botnet's own P2P architecture against it by sinkholing domains — a technique that highlights how resilient decentralized malware can be without proactive network visibility. The presence of cryptocurrency clippers like EggJagger on infected hosts demonstrates the real financial harm sustained by victims over years of undetected compromise. This case underscores that long-lived botnets thrive in environments with poor endpoint telemetry, weak egress filtering, and no network segmentation to contain lateral spread.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- domain — forex2030.com
- domain — kharkovforum.com