[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fDDvCmWYpIadCp8TCw0Q6SKRrJM4fUUGN-6CQVpzcnQE":3},{"article":4,"iocs":51,"watch_terms":52,"solutions":53,"lesson":148},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":28,"category":29,"article_tags":33},"d67eae05-205e-4402-bd70-b4ee93c117f2","Sality botnet infrastructure dismantled in joint global takedown","sality-botnet-infrastructure-dismantled-in-joint-global-takedown-db2015","International law enforcement agencies and private partners have seized Sality malware infrastructure in a joint action aiming to disrupt and take down the peer-to-peer (P2P) botnet. [...]","A coordinated international operation has successfully dismantled the Sality botnet, a peer-to-peer network active for over 20 years. Law enforcement agencies in the US, Bulgaria, Hungary, and Romania seized Sality-linked domains, while CrowdStrike sinkholed its control channels. The botnet, attributed to the SALTY SPIDER group operating from Russia, primarily pushed the EggJagger clipjacking malware and has historically been used for various malicious activities.","Global law enforcement and private partners dismantle the Sality botnet after two decades of operation.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fsality-botnet-infrastructure-dismantled-in-joint-global-takedown\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2026\u002F09\u002F02\u002FSality.jpg","2026-09-02T08:00:43+00:00","2026-09-02T10:00:10.146939+00:00",8,[17,20,23,26],{"name":18,"type":19},"SALTY SPIDER","threat_actor",{"name":21,"type":22},"CrowdStrike","vendor",{"name":24,"type":25},"Europol","product",{"name":27,"type":25},"Eurojust","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":28,"icon":30,"name":31,"slug":32},null,"Malware","malware",[34,39,41,46],{"category":35},{"id":36,"icon":30,"name":37,"slug":38},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":40},{"id":28,"icon":30,"name":31,"slug":32},{"category":42},{"id":43,"icon":30,"name":44,"slug":45},"c5eccf7c-abbc-4bd3-bbed-e6da5cba8e73","Incident Response","incident-response",{"category":47},{"id":48,"icon":30,"name":49,"slug":50},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[],[21,24,27],{"controls":54,"vendors":142},[55,84,113],{"slug":56,"name":57,"problem":58,"products":59},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[60,68,76],{"vendor_slug":61,"vendor_name":62,"vendor_logo":63,"product_slug":64,"product_name":65,"url":66,"description":67},"elastic","Elastic","\u002Fvendor-logos\u002Felastic.png","elastic-security","Elastic Security","https:\u002F\u002Fwww.elastic.co\u002Fsecurity","SIEM and endpoint security built on Elasticsearch, with open detection rules.",{"vendor_slug":69,"vendor_name":70,"vendor_logo":71,"product_slug":72,"product_name":73,"url":74,"description":75},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-endpoint","Microsoft Defender for Endpoint","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fendpoint-security\u002Fmicrosoft-defender-endpoint","Endpoint detection and response for Windows, macOS, Linux and mobile devices.",{"vendor_slug":77,"vendor_name":78,"vendor_logo":79,"product_slug":80,"product_name":81,"url":82,"description":83},"sentinelone","SentinelOne","\u002Fvendor-logos\u002Fsentinelone.png","singularity-endpoint","Singularity Endpoint","https:\u002F\u002Fwww.sentinelone.com\u002Fplatform\u002Fendpoint-security\u002F","Endpoint protection and detection with automated response and rollback.",{"slug":85,"name":86,"problem":87,"products":88},"network-detection-response","Network detection and response (NDR)","Attackers moving between systems inside the network get seen.",[89,97,105],{"vendor_slug":90,"vendor_name":91,"vendor_logo":92,"product_slug":93,"product_name":94,"url":95,"description":96},"corelight","Corelight","\u002Fvendor-logos\u002Fcorelight.png","open-ndr","Corelight Open NDR","https:\u002F\u002Fcorelight.com\u002Fplatform\u002F","Network detection and response based on Zeek and Suricata.",{"vendor_slug":98,"vendor_name":99,"vendor_logo":100,"product_slug":101,"product_name":102,"url":103,"description":104},"darktrace","Darktrace","\u002Fvendor-logos\u002Fdarktrace.png","darktrace-network","Darktrace \u002F NETWORK","https:\u002F\u002Fwww.darktrace.com\u002Fproducts\u002Fhybrid-network","Network detection and response based on learning normal behaviour.",{"vendor_slug":106,"vendor_name":107,"vendor_logo":108,"product_slug":109,"product_name":110,"url":111,"description":112},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",{"slug":114,"name":115,"problem":116,"products":117},"dns-web-filtering","DNS filtering and secure web gateway","Users cannot reach known-malicious sites, and malware cannot phone home.",[118,126,134],{"vendor_slug":119,"vendor_name":120,"vendor_logo":121,"product_slug":122,"product_name":123,"url":124,"description":125},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","prisma-access","Prisma Access","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fsase\u002Faccess","Cloud-delivered SASE: zero trust access to private apps and secure web gateway.",{"vendor_slug":127,"vendor_name":128,"vendor_logo":129,"product_slug":130,"product_name":131,"url":132,"description":133},"netskope","Netskope","\u002Fvendor-logos\u002Fnetskope.png","netskope-swg","Netskope Secure Web Gateway","https:\u002F\u002Fwww.netskope.com\u002Fproducts\u002Fnext-gen-swg","Cloud secure web gateway with inspection of web and cloud app traffic.",{"vendor_slug":135,"vendor_name":136,"vendor_logo":137,"product_slug":138,"product_name":139,"url":140,"description":141},"cisco","Cisco","\u002Fvendor-logos\u002Fcisco.png","umbrella","Cisco Umbrella","https:\u002F\u002Fumbrella.cisco.com\u002F","DNS-layer security and secure web gateway delivered from the cloud.",[143],{"slug":144,"name":21,"logo_path":145,"roles":146},"crowdstrike","\u002Fvendor-logos\u002Fcrowdstrike.png",[147],"reported_by",{"slug":149,"title":150,"body":151,"framework_refs":152,"framework_notes":163},"sality-botnet-dismantled-after-20-years-of-global-malicious-activity","Sality Botnet Dismantled After 20 Years of Global Malicious Activity","The Sality botnet persisted for over two decades by leveraging a resilient peer-to-peer architecture that made it difficult to dismantle through conventional means, ultimately requiring a coordinated multinational law enforcement and private-sector effort. Its longevity highlights how infected endpoints can remain active botnet nodes for years when organizations lack visibility into outbound traffic anomalies and endpoint behavioral indicators. The botnet's primary payload, EggJagger clipjacking malware, posed a direct financial threat by silently redirecting cryptocurrency transactions on victim machines. This case underscores that without proactive endpoint monitoring, threat intelligence sharing, and international cooperation, threat actors can sustain infrastructure for extended periods with minimal disruption. Organizations that failed to detect Sality infections likely lacked adequate endpoint detection, network traffic analysis, or threat-hunting capabilities.",[153,154,155,156,157,158,159,160,161,162],"CIS Control 7 – Continuous Vulnerability Management","CIS Control 13 – Network Monitoring and Defense","CIS Control 17 – Incident Response Management","NIST SP 800-61 – Computer Security Incident Handling Guide","NIST SI-3 – Malicious Code Protection","NIST SI-4 – System Monitoring","MITRE ATT&CK T1571 – Non-Standard Port (C2)","MITRE ATT&CK T1583.001 – Acquire Infrastructure: Domains","MITRE ATT&CK T1115 – Clipboard Data","ITIL – Problem Management (root cause elimination of recurring threats)",{}]