Executive Summary
On August 31, 2026, a coordinated international operation led by CrowdStrike and law enforcement agencies disrupted the Sality peer-to-peer (P2P) botnet, which had operated for over two decades. The botnet, managed by the threat actor SALTY SPIDER, infected over 33,000 machines globally, primarily using them for cryptocurrency theft via the EggJagger clipjacking malware and occasional politically or personally motivated DDoS attacks.
The technical disruption exploited Sality's lack of peer authentication and its rigid, file-infector-based protocol. By injecting sinkhole nodes into the P2P network and manipulating peer lists, defenders isolated infected bots from the operator's control. This 'peer list manipulation' rendered the command channel inert, as the malware's architecture prevented the operator from easily patching or updating the protocol without fragmenting the network.
While the disruption prevents the operator from issuing new commands or payloads, existing infections remain active on victim systems. The Sality botnet has targeted various sectors including financial forums and cryptocurrency exchanges. Organizations must remediate legacy infections to prevent further secondary payload execution and potential data loss.