A botnet running for 23 years with over 15,000 endpoints has finally been shut down by law enforcement and Crowdstrike

Crowdstrike and law enforcement disrupted Sality , a peer‑to‑peer botnet active since 2003 Botnet spread malware and clipboard hijacker EggJagger , stealing $150K in cryptocurrency Operation sinkholed endpoints and removed payload URLs, coordinated with DOJ, FBI, Europol, and others Security experts

<![CDATA[ <article> <ul><li><strong>Crowdstrike and law enforcement disrupted </strong><em><strong>Sality</strong></em><strong>, a peer‑to‑peer botnet active since 2003</strong></li><li><strong>Botnet spread malware and clipboard hijacker </strong><em><strong>EggJagger</strong></em><strong>, stealing $150K in cryptocurrency</strong></li><li><strong>Operation sinkholed endpoints and removed payload URLs, coordinated with DOJ, FBI, Europol, and others</strong></li></ul><p>Security experts Crowdstrike, together with a handful of national and international law enforcement agencies, finally managed to disrupt Sality, a peer-to-peer botnet that operated unabated for more than two decades. </p><p>Sality first emerged in 2003. Unlike classic botnets which receive instructions and report back to a single, central entity, this botnet’s endpoints (some 15,000 of them) communicated among themselves, which made it more difficult to track and destroy.</p><p>Throughout its long history, Sality’s key feature was to deploy additional payloads to infected machines. The endpoints were being poisoned with a wide variety of different <a href="https://www.techradar.com/best/best-malware-removal" target="_blank">malware</a> that facilitated credential theft, spam, proxy services, and distributed denial of service (DDoS) attacks. However, between 2018 and today, Sality was primarily used to deploy EggJagger, a clipboard hijacking tool seen in cryptocurrency theft.</p><h2 id="sinkholing-the-botnet">Sinkholing the botnet</h2><p>Cryptocurrency wallet addresses are a long string of random characters, which are almost impossible, and definitely impractical, to remember by heart. Instead, when users want to send their money, they simply copy and paste the recipient’s wallet address into their own. EggJagger monitors this behavior, and when it spots something resembling a wallet address being copied, it replaces the string in the clipboard. Thus, when the victim hits “paste”, they end up adding the attacker’s wallet address instead. </p><p>According to Crowdstrike, from this malware alone, Sality’s operators raked in more than $150,000. </p><p>The researchers disrupted the botnet by sinkholing the endpoints. They first added a few of their own devices into the botnet and whenever others tried to communicate with them, the researchers would purge their peers list, essentially blinding them.</p><p>Crowdstrike also coordinated with international law enforcement to take down the URLs that were hosting the botnet’s payloads. “Disrupting Sality’s ability to download these files ensures that bots still carrying active URL packs cannot retrieve new payloads during the transition period,” they explained.</p><p>The operation was carried out in partnership with the US Department of Justice (DOJ), the Federal Bureau of Investigation (FBI), the Department of Defense Office of Inspector General’s Defense Criminal Investigative Service (DCIS), and the Shadowserver Foundation, with support from Europol, Eurojust, and law enforcement agencies in Bulgaria, Hungary, and Romania. </p><p>“We also acknowledge additional unnamed partners whose contributions were essential to the success of this operation,” Crowdstrike concluded.</p><p><em>Via </em><a href="https://www.theregister.com/cyber-crime/2026/09/02/cops-crowdstrike-disrupt-sality-botnet-by-poisoning-the-network-and-diverting-into-sinkholes/5293795" target="_blank"><em>The Register</em></a></p> </article> ]]>