Full Report
International law enforcement agencies and private partners have seized Sality malware infrastructure in a joint action aiming to disrupt and take down the peer-to-peer (P2P) botnet. [...]
Analysis Summary
# Incident Report: Global Disruption of the Sality P2P Botnet
## Executive Summary
International law enforcement agencies, in coordination with private sector partners, successfully dismantled the long-standing Sality P2P botnet infrastructure. The operation involved seizing critical domains across multiple countries and implementing a sinkhole strategy to sever the botnet's peer-to-peer control channels. This action effectively neutralized a botnet that had been active for over two decades, infecting at least 15,000 devices used for credential theft and cryptocurrency hijacking.
## Incident Details
- **Discovery Date:** Active since 2003; Takedown finalized September 2026.
- **Incident Date:** September 2026 (Takedown action).
- **Affected Organization:** Distributed network of ~15,000 compromised individual hosts.
- **Sector:** Cross-sector (Consumers and Organizations).
- **Geography:** Global, with infrastructure seized in the U.S., Bulgaria, Hungary, and Romania.
## Timeline of Events
### Initial Access
- **Date/Time:** Circa 2003 (Initial emergence).
- **Vector:** Sality traditionally utilized file infection (infecting executables), removable drives, and network shares.
- **Details:** The malware propagated as a polymorphic file infector, allowing it to spread autonomously across internal networks.
### Lateral Movement
- Sality utilized peer-to-peer (P2P) communication to distribute "file packs" and "URL packs" between infected hosts, avoiding the need for a single central command server and allowing the network to heal itself.
### Data Exfiltration/Impact
- **Clipjacking:** Monitoring clipboards for cryptocurrency addresses and replacing them with attacker-controlled addresses (EggJagger payload).
- **Secondary Impact:** Credential theft, spam distribution, proxy services, and DDoS attacks.
### Detection & Response
- **Discovery:** Long-term monitoring by CrowdStrike’s Counter Adversary Operations and global law enforcement.
- **Response Actions:** A joint operation (September 2026) involving the DOJ, FBI, DCIS, and European agencies seized Sality-linked domains. CrowdStrike implemented a "super-peer sinkhole" to purge peer lists and block payload propagation.
## Attack Methodology
- **Initial Access:** File infection, network shares, and removable media.
- **Persistence:** Infecting system executables and creating registry keys to ensure execution on startup.
- **Defense Evasion:** Polymorphic code (changing its own signature) and disabling security software/antivirus services on infected hosts.
- **Credential Access:** Credential theft modules distributed via botnet packs.
- **Lateral Movement:** Spreading via P2P architecture and local network discovery.
- **Collection:** Clipboard monitoring via the EggJagger malware.
- **Exfiltration:** P2P routing of stolen data or direct communication with operator-controlled addresses.
- **Impact:** Financial theft (cryptocurrency) and loss of system integrity.
## Impact Assessment
- **Financial:** Significant, via eight years of active "clipjacking" (redirecting crypto transactions).
- **Data Breach:** Widespread credential theft over a 20-year period.
- **Operational:** High; infected machines were used as proxies and DDoS nodes.
- **Reputational:** Broad public impact due to the longevity and scale of the botnet.
## Indicators of Compromise
- **Network Indicators:**
- Communication with known Sality P2P "super peers."
- Traffic to seized domains (e.g., [defanged] example[.]com).
- **File Indicators:**
- Presence of EggJagger malware payloads.
- Polymorphic infections of standard Windows executable files (.exe / .scr).
- **Behavioral Indicators:**
- Unexplained modification of cryptocurrency addresses during copy-paste operations.
- Local security software failing to start or being forcibly disabled.
## Response Actions
- **Containment:** Sinkholing of the P2P control backbone to prevent new commands from reaching bots.
- **Eradication:** Global seizure of command-and-control (C2) domains.
- **Recovery:** Purging of peer lists on infected machines to isolate them from the botnet.
## Lessons Learned
- **Longevity:** Sality’s 20-year lifespan highlights the effectiveness of P2P architectures in evading traditional centralized takedowns.
- **Collaboration:** Successful disruption required high-level coordination between private cybersecurity firms and multiple international government agencies.
- **Evolving Payloads:** The shift from general spam to specific clipjacking (EggJagger) shows how legacy botnets adapt to maximize financial gain from modern technologies.
## Recommendations
- **Defense in Depth:** Use EDR (Endpoint Detection and Response) tools that monitor for behavioral anomalies (like service disabling) rather than just file signatures.
- **Network Segmentation:** Limit the ability of P2P traffic to move laterally across organizational networks.
- **Integrity Checks:** Regularly verify the integrity of system binaries and executables to detect file-infector malware.