A Windows peer-to-peer botnet whose most profitable trick in recent years was to intercept cryptocurrency payments has been separated from its operator by an international law enforcement action executed on Monday, August 31, and made public the following day.
Sality, first observed in 2003, had been used for two decades as a delivery system for whatever payload paid best, and for the last eight of those years the payload was a clipboard hijacker called EggJagger that swapped copied Bitcoin and Ethereum wallet addresses for ones controlled by the operator.
The isolation of the network was not a raid, an indictment, or a wallet seizure. It was a protocol-level engineering exercise, and it undid a design that had outlived every generation of takedown technique previously aimed at it.
The technical cutover was executed by CrowdStrike’s Counter Adversary Operations team, which set out the mechanics in a technical write-up titled Peer Pressure: Inside the Sality Botnet Disruption Operation, published on September 1. The firm said more than 15,000 infected machines were isolated in a peer-to-peer sinkhole operation, and that the operator has lost the ability to send new tasking or push new payloads to any of them.
Two independent Sality networks, tracked as version 3 and version 4, were both active until this week. They shared a codebase and, in CrowdStrike’s assessment, a single operator, but ran incompatible protocols and different cryptographic keys.
Europol, which published its own account of the operation on September 2, described a much larger historical footprint. The agency said the infrastructure has been linked over its lifetime to more than 11 million unique IP addresses, and that at peak the operator had access to as many as one million infected machines worldwide. Those numbers are not interchangeable with CrowdStrike’s live count.
The 11 million figure is a running total across two decades. The 15,000 is the set of machines still under the operator’s control this week. The one-million peak is an earlier high-water mark.
The public U.S. announcement came from the U.S. Attorney’s Office for the Central District of California on Tuesday, September 1, describing a multinational operation to disrupt the botnet and malware known as Sality and take down its infrastructure.
The Justice Department (DOJ), Federal Bureau of Investigation (FBI), and Defense Criminal Investigative Service (DCIS) seized Sality-linked domains in the United States, while authorities in Bulgaria, Hungary, and Romania acted against additional Sality-linked domains hosted in Europe.
First Assistant U.S. Attorney Bill Essayli said in the release that cybercriminals, botnets and malware are a “clear and present danger” to national security and the economy. No defendant was named. No arrest was announced.
Reuters, reporting from CrowdStrike’s Day Zero threat-intelligence summit in Las Vegas, said the Justice Department told the wire service the operation was based in Russia but declined to elaborate, and that the Russian Embassy in Washington did not immediately respond to a request for comment.
Small dollar figure, larger design story
Modern crypto-crime headlines are dominated by drainers, exchange breaches and mixers that move nine or ten figures at a time. Sality’s confirmed take is nothing like that. According to the CrowdStrike technical write-up, the operator stole at least ₽12.1 million (~$150,000) through EggJagger over its eight-year run.
The never-spent portfolio value peaked at around ₽147 million in January 2025, a nominal figure the firm places near $1.35 million. That estimate covers only the clipper. Other payloads Sality delivered over the years, from credential theft to spam and proxy services, were separate revenue lines.
What makes the numbers smaller than the coverage is also what makes the disruption interesting. Sality had no server to seize because it did not run one. It had no admin panel to break into because there was no panel. It kept spreading because it did not need spam runs or exploit kits; it attached itself to Windows executables and rode network shares, removable drives, and file sharing. That let a single operator remain online for two decades on almost no overhead. It also meant the operator could not release a hardened update without competing with the existing strain for the same host files and fragmenting the botnet.
The protocol behavior the bots ran in 2026 was, as CrowdStrike put it, the protocol behavior of roughly 20 years earlier. Every weakness in that protocol was permanent, and the takedown weaponized the oldest of them: bots accepted any publicly reachable machine that answered the handshake correctly, with no authentication and no cryptographic identity.
How the sinkhole worked
Every Sality bot keeps a list of super peers, which are publicly reachable infected machines that form the network’s backbone. Every 40 minutes, the bot checks whether those peers are still online. Live peers accumulate reputation; silent ones are dropped.
The disruption used that maintenance cycle against the network itself. Legitimate super peers were invalidated inside each bot’s list and replaced with defender-controlled sinkholes. Super peers were hit first.
The majority of infections that sit behind firewalls or network address translation were purged in place when they reached out to a sinkhole during their normal check-in. From the operator’s view, per the CrowdStrike account, infected machines simply disappear.
The method belongs to the same family used in the 2014 GameOver Zeus and 2017 Kelihos peer-list operations, adapted to Sality’s protocol. In parallel, law enforcement took down the URLs currently hosting Sality payloads, so bots still holding old lists could not fetch new files during the transition.
For network defenders, CrowdStrike published YARA rules keyed to the embedded RSA public keys for versions 3 and 4, the last URL packs distributed before the cutover, and a sinkhole “lighthouse” IP address at 188.166.101.148. Any UDP traffic to that address, the firm said, indicates an active infection.
Three DDoS payloads outside the pattern
While Sality’s day job for the past eight years was clipping crypto, CrowdStrike traced three occasions when the same operator pointed the botnet at something more personal or political.
An April 2016 payload knocked forex2030[.]com offline, an Arabic-language site covering natural-resource trading firms, for reasons the firm was unable to determine with confidence. On February 25, 2022, one day after Russia’s full-scale invasion of Ukraine, a Sality payload flooded kharkovforum[.]com, a Ukrainian web forum that hosted a thread about the offensive on Kharkiv, with HTTP traffic. In September 2023, a payload targeted AvanChange, a Russian cryptocurrency exchange, and was compiled seconds before it was uploaded to the distribution infrastructure, which the firm reads as an impulsive reaction to a personal grievance.
CrowdStrike attributes the operator to a group it tracks as SALTY SPIDER, assessed as likely operating out of the Republic of Bashkortostan in Russia, and suggests the operator probably used exchanges of that kind to convert stolen coins into fiat.
What isolation does not do
Removing the operator’s control channel does not remove the malware from the machines it was running on. That distinction is the practical takeaway for anyone waking up to a possible Sality infection.
CrowdStrike’s guidance is that any host beaconing to the published sinkhole address should be treated as infected, that running processes should be scanned with its YARA rules, and that the malware itself needs to be removed. Isolation is not cleanup. The Shadowserver Foundation is working with internet service providers and computer security incident response teams (CSIRTs) on victim notification.
Clippers did not become obsolete on August 31, either. They remain a common commodity payload across current malware campaigns, delivered by other loaders and, increasingly, by fake wallet apps. The habit CrowdStrike suggests is the old one, repeated with new emphasis: for anyone moving cryptocurrency from a desktop machine, confirm the destination address on a hardware wallet screen or a trusted address book before signing, rather than trusting the address that ended up in the clipboard.
Not the same case as the week’s other cyber headlines
The Sality action is not Operation Endgame, the multi-year, EU-supported campaign against droppers and infostealers whose most recent wave in November 2025 targeted Rhadamanthys, VenomRAT and Elysium. It is also separate from the crypto-fundraising seizures the Justice Department announced against Hamas-linked networks the same week, and from an unrelated freelancer-malware indictment in California.
Sality is an older, file-infecting P2P design that predates most current takedown targets, and this operation dismantled its distribution path rather than jailing the operator.
What remains open
Officials have not said whether they control the wallets EggJagger was routing funds into, whether an indictment is sealed, or how many of the 15,000 isolated hosts have been cleaned. Sality’s creator has not been publicly identified.
Reuters quoted the Shadowserver Foundation’s David Watson putting the next question plainly: whether the operator tries to rebuild. On the technical side, the answer is bounded. The protocol that kept Sality alive for 23 years cannot be patched without splitting the botnet. That is the point of this week’s takedown, and also the reason the story is not necessarily finished.
Also Read: Float Protocol Losses 10.71 ETH After Uniswap V3 Spot Price Manipulation
