Sality botnet infrastructure dismantled in joint global takedown
Global law enforcement and private partners dismantle the Sality botnet after two decades of operation.
Run CrowdStrike?
Get an email when a reviewed story names CrowdStrike, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
Summary
A coordinated international operation has successfully dismantled the Sality botnet, a peer-to-peer network active for over 20 years. Law enforcement agencies in the US, Bulgaria, Hungary, and Romania seized Sality-linked domains, while CrowdStrike sinkholed its control channels. The botnet, attributed to the SALTY SPIDER group operating from Russia, primarily pushed the EggJagger clipjacking malware and has historically been used for various malicious activities.
The lesson from this incident
Full lessonThe Sality botnet persisted for over two decades by leveraging a resilient peer-to-peer architecture that made it difficult to dismantle through conventional means, ultimately requiring a coordinated multinational law enforcement and private-sector effort. Its longevity highlights how infected endpoints can remain active botnet nodes for years when organizations lack visibility into outbound traffic anomalies and endpoint behavioral indicators. The botnet's primary payload, EggJagger clipjacking malware, posed a direct financial threat by silently redirecting cryptocurrency transactions on victim machines. This case underscores that without proactive endpoint monitoring, threat intelligence sharing, and international cooperation, threat actors can sustain infrastructure for extended periods with minimal disruption. Organizations that failed to detect Sality infections likely lacked adequate endpoint detection, network traffic analysis, or threat-hunting capabilities.
What helps against this
How we list vendors
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Network detection and response (NDR)
Attackers moving between systems inside the network get seen.
- DNS filtering and secure web gateway
Users cannot reach known-malicious sites, and malware cannot phone home.