Dogged Russia-based botnet dismantled after 23-year run
Russia-based Sality botnet dismantled after 23-year run infecting 11M+ devices.
Run CrowdStrike?
Get an email when a reviewed story names CrowdStrike, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
Summary
Law enforcement, CrowdStrike, and the Shadowserver Foundation successfully dismantled Sality, a Russia-based peer-to-peer botnet that operated for 23 years and infected over 11 million devices. CrowdStrike targeted the botnet's peer list infrastructure, tricking the network into permanently severing access to infected machines. The coordinated takedown involved the FBI, US Justice Department, Europol, and authorities from Bulgaria, Hungary, and Romania, demonstrating that decentralized P2P architectures are not invulnerable to disruption.
The lesson from this incident
Full lessonThe Sality botnet persisted for 23 years and infected over 11 million devices, highlighting how long-unpatched and poorly monitored endpoints can fuel criminal infrastructure for decades. Its peer-to-peer architecture made it resilient to traditional takedown methods, requiring an innovative approach of poisoning the botnet's own peer lists to sever infected machines from the network. This case demonstrates that decentralized malware networks thrive when organizations fail to maintain endpoint hygiene, apply timely patches, and monitor for indicators of compromise. The sheer longevity of Sality underscores that without sustained vigilance, even aging threats can remain operationally effective at massive scale.
What helps against this
How we list vendors
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Network detection and response (NDR)
Attackers moving between systems inside the network get seen.
- Threat intelligence
Attack campaigns reach your sector, suppliers or software before your team hears about them.
Indicators of Compromise
- malware — Sality