Law enforcement agencies and private-sector partners have dismantled Sality, a peer-to-peer botnet that has been running continuously for more than two decades. The U.S. Department of Justice, FBI, and Defense Criminal Investigative Service seized Sality-linked domains inside the United States, while authorities in Bulgaria, Hungary, and Romania seized additional infrastructure in Europe. Europol and Eurojust coordinated the multinational operation. CrowdStrike’s Counter Adversary Operations team, which tracks the group behind Sality as SALTY SPIDER and assesses it operates from Russia’s Republic of Bashkortostan, conducted a parallel peer-to-peer sinkhole operation that isolated infected machines by poisoning the botnet’s list of super-peer relay nodes — the backbone that spread malware payloads and update instructions across the network.
First detected in 2003, Sality built an infection count of over 15,000 active devices at takedown — a tiny footprint by modern botnet standards, but notable for its persistence. The malware originally spread through infected executable files and USB drives, distributing spam, proxy services, and credential-theft tools over the years. For the past eight years, its primary payload was EggJagger, a clipjacking tool that monitors the Windows clipboard in real time and silently replaces any cryptocurrency wallet address a victim copies with one controlled by the attacker. In a world where most crypto transfers are copy-pasted, a single successful clipboard swap can empty an entire wallet.