[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$foDkzLIqrBoGgJrU_Im3ySeWdjkdYs9-vC60e5Xq8Vrc":3},{"article":4,"iocs":43,"watch_terms":47,"solutions":48,"lesson":142},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":25,"category":26,"article_tags":30},"b3550089-a977-4acf-b186-7ab2cc541b84","Dogged Russia-based botnet dismantled after 23-year run","dogged-russia-based-botnet-dismantled-after-23-year-run-273394","Sality’s peer-to-peer infrastructure allowed it to evade system-wide disruption efforts for an exceptionally long period. Authorities and cybersecurity experts finally brought it down. The post Dogged Russia-based botnet dismantled after 23-year run appeared first on CyberScoop.","Law enforcement, CrowdStrike, and the Shadowserver Foundation successfully dismantled Sality, a Russia-based peer-to-peer botnet that operated for 23 years and infected over 11 million devices. CrowdStrike targeted the botnet's peer list infrastructure, tricking the network into permanently severing access to infected machines. The coordinated takedown involved the FBI, US Justice Department, Europol, and authorities from Bulgaria, Hungary, and Romania, demonstrating that decentralized P2P architectures are not invulnerable to disruption.","Russia-based Sality botnet dismantled after 23-year run infecting 11M+ devices.","https:\u002F\u002Fcyberscoop.com\u002Fsality-botnet-dismantled\u002F","https:\u002F\u002Fcyberscoop.com\u002Fwp-content\u002Fuploads\u002Fsites\u002F3\u002F2026\u002F04\u002FGettyImages-1772548694.jpg","2026-09-02T17:03:58+00:00","2026-09-02T18:00:22.721278+00:00",9,[17,20,22],{"name":18,"type":19},"CrowdStrike","vendor",{"name":21,"type":19},"Shadowserver Foundation",{"name":23,"type":24},"Peer-to-peer botnet infrastructure","technology","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":25,"icon":27,"name":28,"slug":29},null,"Malware","malware",[31,36,38],{"category":32},{"id":33,"icon":27,"name":34,"slug":35},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":37},{"id":25,"icon":27,"name":28,"slug":29},{"category":39},{"id":40,"icon":27,"name":41,"slug":42},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[44],{"type":29,"value":45,"context":46},"Sality","Russia-based peer-to-peer botnet operated for 23 years, infected 11M+ devices, enabled cryptocurrency theft and DDoS attacks",[18,21],{"controls":49,"vendors":136},[50,79,108],{"slug":51,"name":52,"problem":53,"products":54},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[55,63,71],{"vendor_slug":56,"vendor_name":57,"vendor_logo":58,"product_slug":59,"product_name":60,"url":61,"description":62},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-edr","Huntress Managed EDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-edr","Endpoint detection and response monitored around the clock by Huntress analysts.",{"vendor_slug":64,"vendor_name":65,"vendor_logo":66,"product_slug":67,"product_name":68,"url":69,"description":70},"sentinelone","SentinelOne","\u002Fvendor-logos\u002Fsentinelone.png","singularity-endpoint","Singularity Endpoint","https:\u002F\u002Fwww.sentinelone.com\u002Fplatform\u002Fendpoint-security\u002F","Endpoint protection and detection with automated response and rollback.",{"vendor_slug":72,"vendor_name":73,"vendor_logo":74,"product_slug":75,"product_name":76,"url":77,"description":78},"withsecure","WithSecure","\u002Fvendor-logos\u002Fwithsecure.png","elements-xdr","WithSecure Elements XDR","https:\u002F\u002Fwww.withsecure.com\u002Fen\u002Ffor-business\u002Fplatform\u002Fxdr\u002F","Endpoint detection and response with extended detection, on the Elements cloud platform.",{"slug":80,"name":81,"problem":82,"products":83},"network-detection-response","Network detection and response (NDR)","Attackers moving between systems inside the network get seen.",[84,92,100],{"vendor_slug":85,"vendor_name":86,"vendor_logo":87,"product_slug":88,"product_name":89,"url":90,"description":91},"darktrace","Darktrace","\u002Fvendor-logos\u002Fdarktrace.png","darktrace-network","Darktrace \u002F NETWORK","https:\u002F\u002Fwww.darktrace.com\u002Fproducts\u002Fhybrid-network","Network detection and response based on learning normal behaviour.",{"vendor_slug":93,"vendor_name":94,"vendor_logo":95,"product_slug":96,"product_name":97,"url":98,"description":99},"corelight","Corelight","\u002Fvendor-logos\u002Fcorelight.png","open-ndr","Corelight Open NDR","https:\u002F\u002Fcorelight.com\u002Fplatform\u002F","Network detection and response based on Zeek and Suricata.",{"vendor_slug":101,"vendor_name":102,"vendor_logo":103,"product_slug":104,"product_name":105,"url":106,"description":107},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",{"slug":42,"name":109,"problem":110,"products":111},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[112,120,128],{"vendor_slug":113,"vendor_name":114,"vendor_logo":115,"product_slug":116,"product_name":117,"url":118,"description":119},"dataminr","Dataminr","\u002Fvendor-logos\u002Fdataminr.png","agentic-threat-intelligence-platform","Agentic Threat Intelligence Platform","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fagentic-threat-intelligence-platform\u002F","Threat intelligence platform, formerly ThreatConnect TI Ops, that collects, scores and structures intelligence and pushes it into security tools.",{"vendor_slug":121,"vendor_name":122,"vendor_logo":123,"product_slug":124,"product_name":125,"url":126,"description":127},"defused","Defused","\u002Fvendor-logos\u002Fdefused.png","defused-tf","Defused TF","https:\u002F\u002Fdefusedcyber.com\u002Fproduct\u002Ftf","Threat intelligence feed from honeypots Defused runs on several continents, showing which vulnerabilities attackers are exploiting right now, with payloads and indicators.",{"vendor_slug":129,"vendor_name":130,"vendor_logo":131,"product_slug":132,"product_name":133,"url":134,"description":135},"reliaquest","ReliaQuest","\u002Fvendor-logos\u002Freliaquest.png","greymatter-digital-risk-protection","GreyMatter Digital Risk Protection","https:\u002F\u002Freliaquest.com\u002Fsecurity-operations-platform\u002Fdark-web-and-digital-risk-protection\u002F","Watches the open, deep and dark web for threats aimed at an organisation and alerts its security team in real time.",[137],{"slug":138,"name":18,"logo_path":139,"roles":140},"crowdstrike","\u002Fvendor-logos\u002Fcrowdstrike.png",[141],"reported_by",{"slug":143,"title":144,"body":145,"framework_refs":146,"framework_notes":159},"23-year-botnet-dismantled-lessons-from-salitys-long-run","23-Year Botnet Dismantled: Lessons from Sality's Long Run","The Sality botnet persisted for 23 years and infected over 11 million devices, highlighting how long-unpatched and poorly monitored endpoints can fuel criminal infrastructure for decades. Its peer-to-peer architecture made it resilient to traditional takedown methods, requiring an innovative approach of poisoning the botnet's own peer lists to sever infected machines from the network. This case demonstrates that decentralized malware networks thrive when organizations fail to maintain endpoint hygiene, apply timely patches, and monitor for indicators of compromise. The sheer longevity of Sality underscores that without sustained vigilance, even aging threats can remain operationally effective at massive scale.",[147,148,149,150,151,152,153,154,155,156,157,158],"CIS Control 1 – Inventory and Control of Enterprise Assets","CIS Control 2 – Inventory and Control of Software Assets","CIS Control 7 – Continuous Vulnerability Management","CIS Control 13 – Network Monitoring and Defense","NIST SP 800-83 – Guide to Malware Incident Prevention and Handling","NIST SI-3 – Malicious Code Protection","NIST SI-4 – System Monitoring","NIST RA-5 – Vulnerability Monitoring and Scanning","NIST IR-4 – Incident Handling","MITRE ATT&CK – T1071 Application Layer Protocol (C2)","MITRE ATT&CK – T0885 Commonly Used Port (P2P Botnet)","GDPR Article 32 – Security of Processing (for affected EU-based infected endpoints)",{}]