[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fNSgiadi2Cv8SXN0au6CtMb4_NepmOtAgJlg2j5huKJg":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":24,"status":25,"created_at":26,"published_at":27,"article":28,"tags":32,"podcasts":51,"controls":52},"05d0b416-ecc2-436d-b47a-d48b89624ce8","23-year-old-sality-botnet-finally-disrupted-after-decades-of-malware-distribution","467fd7f9-c8b8-452e-8c17-7a5bba69a11c","23-Year-Old Sality Botnet Finally Disrupted After Decades of Malware Distribution","The Sality botnet persisted for 23 years largely because infected endpoints were never identified, remediated, or isolated — a testament to how unmanaged and unmonitored systems can silently serve as malware infrastructure for decades. Sality's P2P architecture made it resilient by eliminating central command-and-control servers, meaning traditional takedown methods were insufficient and required sophisticated peer-list manipulation. The botnet's EggJagger clipjacking payload demonstrates how long-lived infections can pivot to new criminal use cases, such as cryptocurrency theft, long after initial compromise. This case underscores that organizations must continuously scan for and remediate dormant infections rather than assuming they are clean because no alerts have triggered.","**Immediate actions:**\n- Deploy endpoint detection and response (EDR) tools across all systems to identify and quarantine hosts exhibiting P2P botnet communication patterns.\n- Run a full endpoint scan using updated antivirus and anti-malware signatures specifically targeting Sality and related malware families.\n- Block known Sality-associated indicators of compromise (IPs, domains, hashes) at the perimeter firewall and DNS resolver.\n\n**Long-term improvements:**\n- Establish a continuous vulnerability and infection management program that includes periodic sweeps for long-dormant malware on legacy systems.\n- Implement strict application allowlisting on endpoints to prevent unauthorized executables — a primary Sality propagation vector — from running.\n- Maintain an up-to-date hardware and software asset inventory so no unmanaged device can silently participate in a botnet.\n\n**Detection measures:**\n- Monitor outbound network traffic for anomalous P2P communication patterns, unexpected UDP traffic, or connections to newly registered domains.\n- Integrate threat intelligence feeds into your SIEM to receive real-time alerts on known botnet infrastructure and clipjacking-related indicators.\n- Establish baseline behavior for all endpoints and alert on deviations such as unexpected process spawning or clipboard-access events.",[12,13,14,15,16,17,18,19,20,21,22,23],"CIS Control 1: Inventory and Control of Enterprise Assets","CIS Control 2: Inventory and Control of Software Assets","CIS Control 10: Malware Defenses","CIS Control 13: Network Monitoring and Defense","NIST SP 800-61 Rev. 2: Computer Security Incident Handling Guide","NIST SP 800-83: Guide to Malware Incident Prevention and Handling","NIST IR-4: Incident Handling","NIST SI-3: Malicious Code Protection","NIST SI-4: System Monitoring","MITRE ATT&CK T1571: Non-Standard Port (P2P C2)","MITRE ATT&CK T1025: Data from Removable Media (clipjacking variant)","ITIL: Event Management and Problem Management practices",{},"published","2026-09-02T10:21:44.039625+00:00","2026-09-02T10:21:43.734+00:00",{"id":7,"url":29,"slug":30,"title":31},"https:\u002F\u002Fwww.securityweek.com\u002F23-year-old-sality-p2p-botnet-disrupted\u002F","23-year-old-sality-p2p-botnet-disrupted-6a5925","23-Year-Old Sality P2P Botnet Disrupted",[33,39,45],{"id":34,"name":35,"slug":36,"description":37,"color":38},"05757c8d-6b93-4194-b35d-7359e7d33b0e","Vulnerability Management","vulnerability-management","Missing scans, no risk prioritization","#fb923c",{"id":40,"name":41,"slug":42,"description":43,"color":44},"1732a005-556e-411c-a9db-5edec3058571","Logging & Monitoring","logging-monitoring","Missing logs, no alerting, blind spots","#a855f7",{"id":46,"name":47,"slug":48,"description":49,"color":50},"182e11d5-57c4-444e-8ec8-4682ad60261b","Incident Response","incident-response","Slow detection, poor containment, missing playbooks","#14b8a6",[],[53,57,61],{"slug":54,"name":55,"problem":56},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",{"slug":58,"name":59,"problem":60},"network-detection-response","Network detection and response (NDR)","Attackers moving between systems inside the network get seen.",{"slug":62,"name":63,"problem":64},"dns-web-filtering","DNS filtering and secure web gateway","Users cannot reach known-malicious sites, and malware cannot phone home."]