[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fhDEP2x3GQ_JkGlmSw8-PM0QUXhjx0jGRpQlq2Tc_WVM":3},{"article":4,"iocs":56,"watch_terms":63,"solutions":64,"lesson":67},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":33,"category":34,"article_tags":38},"10faa14a-e8c7-47c7-965f-8668e735cc66","Authorities Turn Sality's P2P Network Against Itself, Cutting Off New Malware Payloads","authorities-turn-sality-s-p2p-network-against-itself-cutting-off-new-malware-pay-81c96c","The U.S. Department of Justice (DoJ) on Tuesday announced the takedown of a long-standing peer-to-peer (P2P) botnet known as Sality as part of a coordinated law enforcement operation. The effort was undertaken on August 31, 2026, by authorities from the U.S., Bulgaria, Hungary, and Romania, in collaboration with private industry partners CrowdStrike and the Shadowserver Foundation. To that","A coordinated law enforcement operation involving the U.S. DoJ, Bulgaria, Hungary, and Romania, alongside CrowdStrike and Shadowserver Foundation, has successfully taken down the Sality peer-to-peer botnet. The operation utilized a sinkhole strategy to sever communication and seize Sality-linked domains, effectively neutralizing the malware's ability to distribute new payloads and infect machines worldwide. Sality, active since 2003, has been responsible for delivering various malicious software, including the cryptocurrency clipper EggJagger, and has been repurposed for DDoS attacks.","Authorities dismantled the Sality P2P botnet, disrupting malware distribution.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F09\u002Fauthorities-turn-salitys-p2p-network.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEgDpXbKu79XC2ObZuqgBEMG9E1VR-SyLdDwhylzbIupomfXEbDe_gUT29NNntDVz9NtiGLhnHJdrq1GyC5RbPHozyzmCVov6JJIg2sCiCb5Jp8SHEInYNR5PRE06TrBh4Oqy8WT7GbTtGOZisMrKuCWaUWn5vaJkbHPmhTEb7O0voiiBDdYHcxc02YhLBb1\u002Fs1600\u002Fbotnet-malware.jpg","2026-09-02T06:56:30+00:00","2026-09-02T08:00:21.049843+00:00",8,[17,20,23,25,28,31],{"name":18,"type":19},"EggJagger","product",{"name":21,"type":22},"CrowdStrike","vendor",{"name":24,"type":22},"Shadowserver Foundation",{"name":26,"type":27},"P2P botnet","technology",{"name":29,"type":30},"Sality","threat_actor",{"name":32,"type":22},"Dragos","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":33,"icon":35,"name":36,"slug":37},null,"Malware","malware",[39,44,46,51],{"category":40},{"id":41,"icon":35,"name":42,"slug":43},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":45},{"id":33,"icon":35,"name":36,"slug":37},{"category":47},{"id":48,"icon":35,"name":49,"slug":50},"c5eccf7c-abbc-4bd3-bbed-e6da5cba8e73","Incident Response","incident-response",{"category":52},{"id":53,"icon":35,"name":54,"slug":55},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[57,61],{"type":58,"value":59,"context":60},"domain","forex2030.com","Targeted in a DDoS attack campaign attributed to Sality.",{"type":58,"value":62,"context":60},"kharkovforum.com",[21,24,32],{"controls":65,"vendors":66},[],[],{"slug":68,"title":69,"body":70,"framework_refs":71,"framework_notes":82},"sality-botnet-dismantled-via-sinkhole-operation","Sality Botnet Dismantled via Sinkhole Operation","The Sality botnet, active since 2003, persisted for over two decades largely because infected endpoints lacked adequate monitoring and isolation controls, allowing peer-to-peer command-and-control traffic to go undetected. Authorities ultimately had to turn the botnet's own P2P architecture against it by sinkholing domains — a technique that highlights how resilient decentralized malware can be without proactive network visibility. The presence of cryptocurrency clippers like EggJagger on infected hosts demonstrates the real financial harm sustained by victims over years of undetected compromise. This case underscores that long-lived botnets thrive in environments with poor endpoint telemetry, weak egress filtering, and no network segmentation to contain lateral spread.",[72,73,74,75,76,77,78,79,80,81],"CIS Control 7: Continuous Vulnerability Management","CIS Control 13: Network Monitoring and Defense","CIS Control 17: Incident Response Management","NIST SP 800-61 Rev. 2: Computer Security Incident Handling Guide","NIST SI-3: Malicious Code Protection","NIST SI-4: Information System Monitoring","NIST SC-7: Boundary Protection (Network Segmentation)","MITRE ATT&CK T1071: Application Layer Protocol (C2)","MITRE ATT&CK T1583.001: Acquire Infrastructure – Domains","ITIL: Event Management and Incident Management processes",{}]