Reported by 3 outlets

Timeline

1. original reporting

   Sality botnet infrastructure dismantled in joint global takedown

   bleepingcomputer.com · 41d ago · September 2nd, 2026

   International law enforcement agencies and private partners have seized Sality malware infrastructure in a joint action aiming to disrupt and take down the peer-to-peer (P2P) botnet. As part of this operation, the U.S. Department of Justice (DOJ), FBI, and DCIS seized Sality-linked domains in the United States, while law enforcement partners in Bulgaria, Hungary, and Romania seized additional Sality-linked domains hosted in Europe. CrowdStrike's Counter Adversary Operations team, in collaboration with international law enforcement and private industry partners, also dismantled the botnet's control channels in a peer-to-peer sinkhole operation that isolated infected machines. The Sality botnet has been active for more than two decades and has infected over 15,000 devices with malware since at least 2003, when it first surfaced. CrowdStrike says Sality is controlled by a criminal group it tracks as SALTY SPIDER , which is likely operating out of the Republic of Bashkortostan in Russia. "The victim computers infected with Sality were part of a peer-to-peer (P2P) botnet, which is a network of computers (each a 'bot) infected with the Sality malware and controlled by the Sality operator," the DOJ said . According to CrowdStrike, the two separate Sality botnet networks that were still active when the takedown took place this week were mainly used to push EggJagger malware payloads in clipjacking attacks. Throughout its history, Sality distributed a wide variety of distinct malware

2. update from malware.news

   Peer Pressure: Inside the Sality Botnet Disruption Operation

   malware.news · 42d ago · September 1st, 2026

   Article Link: Inside the Sality Botnet Disruption Operation | CrowdStrike

3. update from malware.news

   Global public-private operation disrupts Sality botnet active for two decades

   malware.news · 41d ago · September 2nd, 2026

   An international operation supported by Europol has disrupted the Sality peer-to-peer (P2P) botnet, a long-running criminal infrastructure used to distribute malicious payloads to thousands of infected computers worldwide.The coordinated action, carried out on 31 August 2026 and led by the US authorities, targeted a botnet believed to have been operating for more than two decades.

4. update from securityweek.com

   23-Year-Old Sality P2P Botnet Disrupted

   securityweek.com · 41d ago · September 2nd, 2026

   First observed in 2003, Sality has been used for distributing various malware families, including information stealers, proxy services, distributed denial-of-service (DDoS) payloads, and more. For the past eight years, it mainly served the EggJagger clipjacking tool, which is believed to have stolen at least $150,000 in Bitcoin and Ethereum. Sality remained active due to its architecture: it spread through a file infector, attaching itself to executables on disk and removable media, and did not rely on a central command-and-control (C&C) server for receiving code updates. The protocol behavior that allowed the botnet to persist for over 20 years was also the weakness that led to its demise: it blindly trusted the peers on the network, without authentication or identity verification. Sality bots periodically checked if the peers in their list of super peers (infected machines forming the backbone of the P2P network) were accessible. Those that were online built reputation, while those offline lost it and were eventually purged. Exploiting this behavior, CrowdStrike performed protocol-level manipulation of the list, removing the super peer entries to progressively isolate infected machines, while injecting sinkholes into the list. Coordinating with CrowdStrike’s bot isolation and P2P network sinkholin