23-Year-Old Sality P2P Botnet Disrupted

The Sality botnet persisted for 23 years largely because infected endpoints were never identified, remediated, or isolated — a testament to how unmanaged and unmonitored systems can silently serve as malware infrastructure for decades. Sality's P2P architecture made it resilient by eliminating central command-and-control servers, meaning traditional takedown methods were insufficient and required sophisticated peer-list manipulation. The botnet's EggJagger clipjacking payload demonstrates how long-lived infections can pivot to new criminal use cases, such as cryptocurrency theft, long after initial compromise. This case underscores that organizations must continuously scan for and remediate dormant infections rather than assuming they are clean because no alerts have triggered.