Sality P2P Botnet Disrupted by Law Enforcement and CrowdStrike via Peer-List Sinkholing

Key facts for Sality P2P botnet disruption

Detection coverage for Sality P2P botnet disruption

As of 2026-09-01, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2284 across Splunk SPL, Microsoft KQL and Sigma, covering 11 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Sality Rootkit Persistence, Defense-Evasion & EggJagger Clipboard-Hijack Chain (SPL)

Correlates unauthorized Registry Run-key persistence, Safe Mode (SafeBoot) boot-key deletion, unsigned rootkit driver loads, AV/security-process termination, credential/wallet-file access, and EggJagger's clipboard-hijacking cryptocurrency-address swap — the post-infection persistence and monetization chain that follows Sality's initial file-infection foothold. Primary query flavor: SPL.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1547.001, T1562.009, T1562.001, T1014, T1553.002, T1115, T1555
• Data sources: sysmon, windows_security, crowdstrike_fdr, device_registry_events
• Severity: critical
• Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=13
(TargetObject="*CurrentVersion\\Run\\*" OR TargetObject="*\\Control\\SafeBoot\\*")
| eval evasion_type=case(match(TargetObject,"SafeBoot"),"T1562.009_safeboot_key_deletion", match(TargetObject,"\\\\Run\\\\"),"T1547.001_unauthorized_run_key")
| append
    [ search index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=6
      | eval evasion_type="T1014_unsigned_driver_load" ]
| append
    [ search index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
      (TargetImage="*MsMpEng.exe" OR TargetImage="*avp.exe" OR TargetImage="*ekrn.exe" OR TargetImage="*avastui.exe" OR TargetImage="*avastsvc.exe")
      (CommandLine="*taskkill*" OR Image="*rundll32.exe" OR Image="*regsvr32.exe")
      | eval evasion_type="T1562.001_av_process_termination" ]
| append
    [ search index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=11
      (TargetFilename="*\\Login Data" OR TargetFilename="*\\key3.db" OR TargetFilename="*\\wallet.dat" OR TargetFilename="*\\logins.json")
      | eval evasion_type="T1555_credential_store_access" ]
| append
    [ search index=crowdstrike sourcetype="crowdstrike:fdr:json" event_simpleName=ClipboardDataCopied
      | regex ClipboardText="^(bc1|1|3)[a-zA-HJ-NP-Z0-9]{25,39}$|^0x[a-fA-F0-9]{40}$"
      | eval evasion_type="T1115_clipboard_wallet_swap_pattern" ]
| stats count min(_time) as first_seen max(_time) as last_seen values(TargetObject) as targetobjects values(ImageLoaded) as images_loaded values(TargetImage) as targeted_av values(TargetFilename) as touched_files values(ClipboardText) as clipboard_samples by ComputerName evasion_type
| eval first_seen=strftime(first_seen,"%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen,"%Y-%m-%d %H:%M:%S")
| sort -last_seen

Microsoft KQL

let RunKeyPersistence = DeviceRegistryEvents
| where Timestamp > ago(24h)
| where RegistryKey has @"CurrentVersion\Run" and ActionType == "RegistryValueSet"
| project Timestamp, DeviceName, Technique="T1547.001", Detail=RegistryKey;
let SafeBootTamper = DeviceRegistryEvents
| where Timestamp > ago(24h)
| where RegistryKey has @"Control\SafeBoot" and ActionType == "RegistryKeyDeleted"
| project Timestamp, DeviceName, Technique="T1562.009", Detail=RegistryKey;
let AvTermination = DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName in~ ("MsMpEng.exe","avp.exe","ekrn.exe","avastui.exe","avastsvc.exe")
| where ProcessCommandLine has "taskkill" or InitiatingProcessFileName in~ ("rundll32.exe","regsvr32.exe")
| project Timestamp, DeviceName, Technique="T1562.001", Detail=ProcessCommandLine;
let CredStoreAccess = DeviceFileEvents
| where Timestamp > ago(24h)
| where FileName in~ ("Login Data","key3.db","wallet.dat","logins.json")
| project Timestamp, DeviceName, Technique="T1555", Detail=FolderPath;
let ClipboardWalletSwap = ClipboardEvents_CL
| where TimeGenerated > ago(24h)
| where ClipboardText_s matches regex @"^(bc1|1|3)[a-zA-HJ-NP-Z0-9]{25,39}$|^0x[a-fA-F0-9]{40}$"
| project Timestamp=TimeGenerated, DeviceName=Computer_s, Technique="T1115", Detail=ClipboardText_s;
RunKeyPersistence
| union SafeBootTamper, AvTermination, CredStoreAccess, ClipboardWalletSwap
| summarize Events=count(), Techniques=make_set(Technique), Details=make_set(Detail) by DeviceName
| order by Events desc

Sigma

title: Sality/EggJagger Persistence and Defense-Evasion Registry Tampering (Run Key + Safe Mode Boot Key Deletion)
id: 4b6e9c2a-1d5f-4a83-9e77-2c8f0a6b3d19
status: experimental
description: Detects creation of unauthorized Registry Run-key persistence entries combined with deletion of Safe Mode (SafeBoot) boot registry keys, consistent with Sality's persistence and remediation-hindering defense-evasion behavior. Part of a multi-signal detection chain that also covers rootkit driver loading (T1014), code-signing abuse (T1553.002), password-store access (T1555), and EggJagger clipboard-hijack wallet-address swapping (T1115) — see the companion SPL/KQL detections for that telemetry.
references:
    - https://www.huntress.com/threat-library/malware/sality
    - https://www.theregister.com/cyber-crime/2026/09/02/cops-crowdstrike-disrupt-sality-botnet-by-poisoning-the-network-and-diverting-into-sinkholes/5293795
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-09-02
tags:
    - attack.persistence
    - attack.t1547.001
    - attack.defense-evasion
    - attack.t1562.009
    - attack.t1562.001
    - attack.t1014
    - attack.t1553.002
    - attack.credential-access
    - attack.t1555
    - attack.collection
    - attack.t1115
    - attack.tool.sality
    - attack.tool.eggjagger
logsource:
    category: registry_event
    product: windows
detection:
    selection_run_key:
        TargetObject|contains: 'CurrentVersion\Run\'
        EventType: 'SetValue'
    selection_safeboot_delete:
        TargetObject|contains: '\Control\SafeBoot\'
        EventType: 'DeleteKey'
    condition: 1 of selection_*
falsepositives:
    - Legitimate software installers registering Run-key startup entries
    - Authorized system administration disabling Safe Mode network/minimal keys during imaging
level: high

Known false positives:

• Legitimate software installers registering Run-key startup entries during authorized deployment
• IT administrators intentionally disabling Safe Mode keys during scripted imaging/reprovisioning
• Password managers or browser sync tools legitimately reading Login Data/key3.db files
• Users manually copying cryptocurrency addresses that happen to match the wallet-format regex without an actual swap occurring

Tuning notes: Require correlation across at least two of the five append blocks (registry + driver/AV-kill + clipboard) before alerting at critical severity to suppress single-signal noise; exclude known password-manager and endpoint-protection update processes from the credential-store-access selection; validate clipboard alerts against actual wallet-address diff (before/after) rather than regex match alone once EDR clipboard-diff telemetry is available.

• 🔒 Sality Polymorphic File-Infector — [indicator] Propagation via Removable Media & Network Shares (KQL) · unlock with TL Creds
• 🔒 Sality Rootkit Persistence, Defense-Evasion & EggJagger Clipboard-Hijack Chain (KQL) · unlock with TL Creds
• 🔒 Sality P2P Encrypted Peer-Exchange, External Proxy Relay & Resource Hijacking (KQL) · unlock with TL Creds
• 🔒 Sality Polymorphic File-Infector — [indicator] Propagation via Removable Media & Network Shares (Sigma) · unlock with TL Creds
• 🔒 Sality Rootkit Persistence, Defense-Evasion & EggJagger Clipboard-Hijack Chain (Sigma) · unlock with TL Creds
• 🔒 Sality P2P Encrypted Peer-Exchange, External Proxy Relay & Resource Hijacking (Sigma) · unlock with TL Creds
• 🔒 Sality Polymorphic File-Infector — [indicator] Propagation via Removable Media & Network Shares (SPL) · unlock with TL Creds
• 🔒 Sality P2P Encrypted Peer-Exchange, External Proxy Relay & Resource Hijacking (SPL) · unlock with TL Creds

Indicators of compromise for Sality P2P botnet disruption

As of 2026-09-01, Threadlinqs Intelligence tracks 11 indicators of compromise for TL-2026-2284.

How Sality P2P botnet disruption works

Sality's primary payload for roughly the past eight years, the clipboard-hijacking cryptocurrency stealer EggJagger, is estimated by CrowdStrike to have stolen at least $150,000.

Sality is a polymorphic, entry-point-obscuring (EPO) file-infecting virus first identified in 2003 that targets Windows .exe and .scr files. Infection inserts polymorphic viral code into the final section of a host file, replaces the original entry point with a decryption stub, and launches a loader thread that pulls in the Sality payload — a design intended to defeat static antivirus signatures. Propagation is both local (recursive infection of drive C:, network-share infection via enumeration — MITRE ATT&CK Taint Shared Content) and removable-media based (USB drive infection paired with autorun.inf files for automatic execution on mount).

What makes Sality unusually durable is its command-and-control layer: rather than relying on centralized servers, infected hosts form a fully decentralized peer-to-peer overlay of up to roughly 1,000 preconfigured peers, exchanging encrypted UDP messages that carry lists of URLs for follow-on payloads. Because there is no single C2 server to seize, Sality has survived over two decades of attempted disruption. Since 2010, variants have added rootkit capability — device drivers with randomized filenames, process termination of security software via NtTerminateProcess, and IP filtering that blocks access to antivirus-vendor websites — and later versions are digitally signed to make hostile takeover of the peer network more difficult. The botnet's monetization stack layered credential theft (cached passwords, keystrokes), Outlook address-book harvesting, spam relay, HTTP proxy abuse, distributed password-cracking/computing tasks, and DDoS capability; for roughly the last eight years its dominant payload has been EggJagger, a clipboard-hijacking cryptocurrency stealer that silently swaps Bitcoin and Ethereum wallet addresses copied to the Windows clipboard for attacker-controlled addresses, which CrowdStrike estimates has netted at least $150,000.

The US Department of Justice, FBI, and the Department of Defense Office of Inspector General's Defense Criminal Investigative Service (DCIS), together with law enforcement in Bulgaria, Hungary, and Romania, coordinated a takedown built around Sality's core dependency: its peer list. CrowdStrike's Counter Adversary Operations team — which researcher Tillmann Werner called 'the most complex botnet takeover we have ever done' — seeded the P2P network with bogus peer-list entries that caused bots to remove legitimate super-peers and adopt sinkhole entries instead, isolating infected machines from the botnet's operators on a roughly 40-minute peer-verification cycle. CrowdStrike began the live technical takedown on August 31, 2026, in front of an audience at its Fal.Con 2026 'Day Zero' Threat Summit in Las Vegas; the DOJ and FBI publicly announced the operation on September 1, 2026, alongside the seizure of Sality-linked domains in the US and, by European partners, in Bulgaria, Hungary, and Romania. The Shadowserver Foundation coordinated with ISPs and CSIRTs on victim identification, notification, and remediation. DOJ officials confirmed the operation was 'based out of Russia' without further attribution detail; the Russian Embassy did not respond to comment requests.

No CVE or software vulnerability is involved — Sality spreads via file infection and removable/shared media rather than exploitation, so remediation is disinfection/reimaging plus peer-list and persistence cleanup rather than patching.

MITRE ATT&CK techniques by tactic:

Collection

T1005 Data from Local System

Defense Evasion

T1014 Rootkit; T1027 Obfuscated Files or Information; T1620 Reflective Code Loading

Credential Access

T1056.001 Input Capture: Keylogging; T1555 Credentials from Password Stores

Command and Control

T1071 Application Layer Protocol; T1090.002 Proxy: External Proxy; T1573.001 Encrypted Channel: Symmetric Cryptography

Lateral Movement

T1080 Taint Shared Content

Initial Access

T1091 Replication Through Removable Media

Impact

T1496 Resource Hijacking

Persistence

T1547.001 Registry Run Keys / Startup Folder

defense-impairment

T1553.002 Subvert Trust Controls: Code Signing; T1685 Disable or Modify Tools; T1688 Safe Mode Boot

Remediation for Sality P2P botnet disruption

Patches

• No CVE or vendor patch applies — Sality propagates through file infection and removable/shared media, not a software vulnerability; remediation is disinfection and reimaging of infected hosts

Immediate actions

• Identify and isolate hosts showing Sality/EggJagger indicators: disabled or non-functional antivirus, unexpected outbound UDP peer-exchange traffic, unauthorized Run-key entries, or missing Safe Mode registry keys
• Block outbound P2P peer-exchange UDP traffic and any residual Sality C2/proxy traffic at the network perimeter
• Restore Safe Mode boot registry entries and remove unauthorized HKCU/HKLM ...\Run persistence entries
• Rotate credentials and revoke sessions for any accounts whose passwords or keystrokes could have been captured on infected hosts
• Audit cryptocurrency transactions initiated from infected endpoints for clipboard-swapped wallet addresses

Workarounds

• Disable AutoRun/AutoPlay for removable media across the environment
• Restrict write access to network shares to limit propagation via infected shared files
• Monitor for clipboard-hijacking behavior (rapid, automated clipboard content changes matching cryptocurrency address patterns)

Longer-term hardening

• Deploy EDR with behavioral detection for rootkit driver loading, AV/security-process termination, and clipboard-monitoring API usage (SetClipboardViewer/AddClipboardFormatListener)
• Enforce application allow-listing and code-signing verification so Sality's own signed-but-illegitimate binaries and rogue Run-key/driver persistence are flagged
• Restrict and monitor write access to network shares and removable media to prevent Taint Shared Content / autorun reinfection
• Subscribe to Shadowserver victim-notification feeds to catch residual Sality infections identified via the disrupted sinkhole telemetry

Affected and fixed versions

• Microsoft — Windows (systems executing infected .exe/.scr files)
  Vulnerable versions: Any Windows version capable of executing infected .exe/.scr binaries or mounting infected removable/network media

Timeline of Sality P2P botnet disruption

• 2003-01-01 locked-ioc-11 first identified as a polymorphic, entry-point-obscuring Windows file-infector; its fully decentralized P2P architecture makes it resistant to centralized takedown from the outset.
• 2010-01-01 locked-ioc-11 variants add rootkit functionality — randomized device drivers, security-process termination, and IP filtering of antivirus-vendor sites.
• 2018-01-01 locked-ioc-10, a clipboard-hijacking cryptocurrency stealer, becomes locked-ioc-11's primary monetization payload, eventually netting an estimated $150,000+ in stolen Bitcoin and Ethereum.
• 2026-08-31 CrowdStrike seeds the locked-ioc-11 P2P network with poisoned peer-list entries, replacing legitimate super-peers with sinkholes and isolating infected hosts on a roughly 40-minute peer-verification cycle.
• 2026-08-31 CrowdStrike's Counter Adversary Operations team begins live dismantling of the locked-ioc-11 botnet before an audience at the Fal.Con 2026 'Day Zero' Threat Summit in Las Vegas.
• 2026-09-01 DOJ and FBI publicly announce the disruption; First Assistant U.S. Attorney Bill Essayli and FBI Assistant Director Patrick Grandy issue statements on the multinational operation.
• 2026-09-01 US DOJ, FBI, and DCIS seize Sality-linked domains domestically; law enforcement in Bulgaria, Hungary, and Romania seize additional Sality-linked domains hosted in Europe.
• 2026-09-02 The Register publishes detailed coverage of the takedown, peer-list poisoning technique, and locked-ioc-10's cryptocurrency-theft impact.

Sources cited for Sality P2P botnet disruption

• Russian Botnet Disrupted in International Cyber Operation (USAO-SDCA) justice.gov · Advisory · 2026-09-01
• CrowdStrike's Fal.Con 2026 Takes Over Mandalay Bay and Launches the Day Zero Threat Summit CrowdStrike · Vendor report · 2026-08-31
• Sality Malware: Analysis, Detection, Removal Huntress · Research · 2026-01-01
• Sality (Wikipedia) en.wikipedia.org · Research · 2026-01-01
• Cops, CrowdStrike disrupt Sality botnet by poisoning the network and diverting into sinkholes The Register · News · 2026-09-02
• Russian malicious software operation dismantled, feds in LA say kesq.com · News · 2026-09-01
• Russian cybercrime operation being dismantled after two decades, US officials and CrowdStrike say investing.com · News · 2026-09-01
• Russian cybercrime operation being dismantled after two decades, US officials and CrowdStrike say japantimes.co.jp · News · 2026-09-02

Threats related to Sality P2P botnet disruption

• Sality P2P Botnet Dismantled After 23 Years by CrowdStrike, FBI, DOJ, and a Europol-Led International Coalition

Previous and next in malware

• Silver Fox Counterfeit Installer Campaign Delivers Persistent, Self-Protecting Implant via Spoofed Vendor Download Sites Previous report
• MoiClient Backdoor: Multi-Stage Evasion via DLL Side-Loading, RPC UAC Bypass, and BYOVD Driver Abuse Next report