# Sality P2P Botnet Disrupted by Law Enforcement and CrowdStrike via Peer-List Sinkholing

> US and European law enforcement, working with CrowdStrike's Counter Adversary Operations team and the Shadowserver Foundation, dismantled Sality — a polymorphic file-infecting P2P botnet active since 2003 with over 15,000 infected machines worldwide — by poisoning bot peer lists with sinkhole entries and seizing associated domains. Sality's primary payload for roughly the past eight years, the clipboard-hijacking cryptocurrency stealer EggJagger, is estimated by CrowdStrike to have stolen at least $150,000.

- **Published:** 2026-09-01T00:00:00Z
- **Last reviewed:** 2026-09-01T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2284
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-sality-p2p-botnet-disruption-tl-2026-2284.webp?v=5bb06a22 (Threadlinqs threat intel: Sality P2P Botnet 23-Year Takedown: Analysis & Hunting (TL-2026-2284) — High severity, 11 IOCs, 9 detection rules.)
- **ID:** TL-2026-2284
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** MONITORING
- **Detections:** 9 (1 shown free below) · **IOCs:** 11

## Description

Sality is a polymorphic, entry-point-obscuring (EPO) file-infecting virus first identified in 2003 that targets Windows .exe and .scr files. Infection inserts polymorphic viral code into the final section of a host file, replaces the original entry point with a decryption stub, and launches a loader thread that pulls in the Sality payload — a design intended to defeat static antivirus signatures. Propagation is both local (recursive infection of drive C:, network-share infection via enumeration — MITRE ATT&CK Taint Shared Content) and removable-media based (USB drive infection paired with autorun.inf files for automatic execution on mount).

What makes Sality unusually durable is its command-and-control layer: rather than relying on centralized servers, infected hosts form a fully decentralized peer-to-peer overlay of up to roughly 1,000 preconfigured peers, exchanging encrypted UDP messages that carry lists of URLs for follow-on payloads. Because there is no single C2 server to seize, Sality has survived over two decades of attempted disruption. Since 2010, variants have added rootkit capability — device drivers with randomized filenames, process termination of security software via NtTerminateProcess, and IP filtering that blocks access to antivirus-vendor websites — and later versions are digitally signed to make hostile takeover of the peer network more difficult. The botnet's monetization stack layered credential theft (cached passwords, keystrokes), Outlook address-book harvesting, spam relay, HTTP proxy abuse, distributed password-cracking/computing tasks, and DDoS capability; for roughly the last eight years its dominant payload has been EggJagger, a clipboard-hijacking cryptocurrency stealer that silently swaps Bitcoin and Ethereum wallet addresses copied to the Windows clipboard for attacker-controlled addresses, which CrowdStrike estimates has netted at least $150,000.

The US Department of Justice, FBI, and the Department of Defense Office of Inspector General's Defense Criminal Investigative Service (DCIS), together with law enforcement in Bulgaria, Hungary, and Romania, coordinated a takedown built around Sality's core dependency: its peer list. CrowdStrike's Counter Adversary Operations team — which researcher Tillmann Werner called 'the most complex botnet takeover we have ever done' — seeded the P2P network with bogus peer-list entries that caused bots to remove legitimate super-peers and adopt sinkhole entries instead, isolating infected machines from the botnet's operators on a roughly 40-minute peer-verification cycle. CrowdStrike began the live technical takedown on August 31, 2026, in front of an audience at its Fal.Con 2026 'Day Zero' Threat Summit in Las Vegas; the DOJ and FBI publicly announced the operation on September 1, 2026, alongside the seizure of Sality-linked domains in the US and, by European partners, in Bulgaria, Hungary, and Romania. The Shadowserver Foundation coordinated with ISPs and CSIRTs on victim identification, notification, and remediation. DOJ officials confirmed the operation was 'based out of Russia' without further attribution detail; the Russian Embassy did not respond to comment requests.

No CVE or software vulnerability is involved — Sality spreads via file infection and removable/shared media rather than exploitation, so remediation is disinfection/reimaging plus peer-list and persistence cleanup rather than patching.

## MITRE ATT&CK

- T1091 Replication Through Removable Media
- T1080 Taint Shared Content
- T1547.001 Registry Run Keys / Startup Folder
- T1027 Obfuscated Files or Information
- T1014 Rootkit
- T1685 Disable or Modify Tools
- T1688 Safe Mode Boot
- T1553.002 Subvert Trust Controls: Code Signing
- T1620 Reflective Code Loading
- T1555 Credentials from Password Stores
- T1056.001 Input Capture: Keylogging
- T1005 Data from Local System
- T1071 Application Layer Protocol
- T1573.001 Encrypted Channel: Symmetric Cryptography
- T1090.002 Proxy: External Proxy
- T1496 Resource Hijacking

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Sality Rootkit Persistence, Defense-Evasion & EggJagger Clipboard-Hijack Chain (SPL)** (`TL-2026-2284-SPL-002`)

Correlates unauthorized Registry Run-key persistence, Safe Mode (SafeBoot) boot-key deletion, unsigned rootkit driver loads, AV/security-process termination, credential/wallet-file access, and EggJagger's clipboard-hijacking cryptocurrency-address swap — the post-infection persistence and monetization chain that follows Sality's initial file-infection foothold. Primary query flavor: SPL.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1547.001, T1562.009, T1562.001, T1014, T1553.002, T1115, T1555
- **Data sources:** sysmon, windows_security, crowdstrike_fdr, device_registry_events
- **Severity:** critical
- **Confidence:** high

### Splunk SPL

```spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=13
(TargetObject="*CurrentVersion\\Run\\*" OR TargetObject="*\\Control\\SafeBoot\\*")
| eval evasion_type=case(match(TargetObject,"SafeBoot"),"T1562.009_safeboot_key_deletion", match(TargetObject,"\\\\Run\\\\"),"T1547.001_unauthorized_run_key")
| append
    [ search index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=6
      | eval evasion_type="T1014_unsigned_driver_load" ]
| append
    [ search index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
      (TargetImage="*MsMpEng.exe" OR TargetImage="*avp.exe" OR TargetImage="*ekrn.exe" OR TargetImage="*avastui.exe" OR TargetImage="*avastsvc.exe")
      (CommandLine="*taskkill*" OR Image="*rundll32.exe" OR Image="*regsvr32.exe")
      | eval evasion_type="T1562.001_av_process_termination" ]
| append
    [ search index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=11
      (TargetFilename="*\\Login Data" OR TargetFilename="*\\key3.db" OR TargetFilename="*\\wallet.dat" OR TargetFilename="*\\logins.json")
      | eval evasion_type="T1555_credential_store_access" ]
| append
    [ search index=crowdstrike sourcetype="crowdstrike:fdr:json" event_simpleName=ClipboardDataCopied
      | regex ClipboardText="^(bc1|1|3)[a-zA-HJ-NP-Z0-9]{25,39}$|^0x[a-fA-F0-9]{40}$"
      | eval evasion_type="T1115_clipboard_wallet_swap_pattern" ]
| stats count min(_time) as first_seen max(_time) as last_seen values(TargetObject) as targetobjects values(ImageLoaded) as images_loaded values(TargetImage) as targeted_av values(TargetFilename) as touched_files values(ClipboardText) as clipboard_samples by ComputerName evasion_type
| eval first_seen=strftime(first_seen,"%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen,"%Y-%m-%d %H:%M:%S")
| sort -last_seen
```

### Microsoft KQL

```kql
let RunKeyPersistence = DeviceRegistryEvents
| where Timestamp > ago(24h)
| where RegistryKey has @"CurrentVersion\Run" and ActionType == "RegistryValueSet"
| project Timestamp, DeviceName, Technique="T1547.001", Detail=RegistryKey;
let SafeBootTamper = DeviceRegistryEvents
| where Timestamp > ago(24h)
| where RegistryKey has @"Control\SafeBoot" and ActionType == "RegistryKeyDeleted"
| project Timestamp, DeviceName, Technique="T1562.009", Detail=RegistryKey;
let AvTermination = DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName in~ ("MsMpEng.exe","avp.exe","ekrn.exe","avastui.exe","avastsvc.exe")
| where ProcessCommandLine has "taskkill" or InitiatingProcessFileName in~ ("rundll32.exe","regsvr32.exe")
| project Timestamp, DeviceName, Technique="T1562.001", Detail=ProcessCommandLine;
let CredStoreAccess = DeviceFileEvents
| where Timestamp > ago(24h)
| where FileName in~ ("Login Data","key3.db","wallet.dat","logins.json")
| project Timestamp, DeviceName, Technique="T1555", Detail=FolderPath;
let ClipboardWalletSwap = ClipboardEvents_CL
| where TimeGenerated > ago(24h)
| where ClipboardText_s matches regex @"^(bc1|1|3)[a-zA-HJ-NP-Z0-9]{25,39}$|^0x[a-fA-F0-9]{40}$"
| project Timestamp=TimeGenerated, DeviceName=Computer_s, Technique="T1115", Detail=ClipboardText_s;
RunKeyPersistence
| union SafeBootTamper, AvTermination, CredStoreAccess, ClipboardWalletSwap
| summarize Events=count(), Techniques=make_set(Technique), Details=make_set(Detail) by DeviceName
| order by Events desc
```

### Sigma

```yaml
title: Sality/EggJagger Persistence and Defense-Evasion Registry Tampering (Run Key + Safe Mode Boot Key Deletion)
id: 4b6e9c2a-1d5f-4a83-9e77-2c8f0a6b3d19
status: experimental
description: Detects creation of unauthorized Registry Run-key persistence entries combined with deletion of Safe Mode (SafeBoot) boot registry keys, consistent with Sality's persistence and remediation-hindering defense-evasion behavior. Part of a multi-signal detection chain that also covers rootkit driver loading (T1014), code-signing abuse (T1553.002), password-store access (T1555), and EggJagger clipboard-hijack wallet-address swapping (T1115) — see the companion SPL/KQL detections for that telemetry.
references:
    - https://www.huntress.com/threat-library/malware/sality
    - https://www.theregister.com/cyber-crime/2026/09/02/cops-crowdstrike-disrupt-sality-botnet-by-poisoning-the-network-and-diverting-into-sinkholes/5293795
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-09-02
tags:
    - attack.persistence
    - attack.t1547.001
    - attack.defense-evasion
    - attack.t1562.009
    - attack.t1562.001
    - attack.t1014
    - attack.t1553.002
    - attack.credential-access
    - attack.t1555
    - attack.collection
    - attack.t1115
    - attack.tool.sality
    - attack.tool.eggjagger
logsource:
    category: registry_event
    product: windows
detection:
    selection_run_key:
        TargetObject|contains: 'CurrentVersion\Run\'
        EventType: 'SetValue'
    selection_safeboot_delete:
        TargetObject|contains: '\Control\SafeBoot\'
        EventType: 'DeleteKey'
    condition: 1 of selection_*
falsepositives:
    - Legitimate software installers registering Run-key startup entries
    - Authorized system administration disabling Safe Mode network/minimal keys during imaging
level: high
```

**Known false positives:**

- Legitimate software installers registering Run-key startup entries during authorized deployment
- IT administrators intentionally disabling Safe Mode keys during scripted imaging/reprovisioning
- Password managers or browser sync tools legitimately reading Login Data/key3.db files
- Users manually copying cryptocurrency addresses that happen to match the wallet-format regex without an actual swap occurring

**Tuning notes:** Require correlation across at least two of the five append blocks (registry + driver/AV-kill + clipboard) before alerting at critical severity to suppress single-signal noise; exclude known password-manager and endpoint-protection update processes from the credential-store-access selection; validate clipboard alerts against actual wallet-address diff (before/after) rather than regex match alone once EDR clipboard-diff telemetry is available.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Sality Polymorphic File-Infector — [indicator] Propagation via Removable Media & Network Shares (KQL) (locked: unlock with TL Creds)
- Sality Rootkit Persistence, Defense-Evasion & EggJagger Clipboard-Hijack Chain (KQL) (locked: unlock with TL Creds)
- Sality P2P Encrypted Peer-Exchange, External Proxy Relay & Resource Hijacking (KQL) (locked: unlock with TL Creds)
- Sality Polymorphic File-Infector — [indicator] Propagation via Removable Media & Network Shares (Sigma) (locked: unlock with TL Creds)
- Sality Rootkit Persistence, Defense-Evasion & EggJagger Clipboard-Hijack Chain (Sigma) (locked: unlock with TL Creds)
- Sality P2P Encrypted Peer-Exchange, External Proxy Relay & Resource Hijacking (Sigma) (locked: unlock with TL Creds)
- Sality Polymorphic File-Infector — [indicator] Propagation via Removable Media & Network Shares (SPL) (locked: unlock with TL Creds)
- Sality P2P Encrypted Peer-Exchange, External Proxy Relay & Resource Hijacking (SPL) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [Cops, CrowdStrike disrupt Sality botnet by poisoning the network and diverting into sinkholes](https://www.theregister.com/cyber-crime/2026/09/02/cops-crowdstrike-disrupt-sality-botnet-by-poisoning-the-network-and-diverting-into-sinkholes/5293795)
- [Russian Botnet Disrupted in International Cyber Operation (USAO-SDCA)](https://www.justice.gov/usao-sdca/pr/russian-botnet-disrupted-international-cyber-operation)
- [Russian malicious software operation dismantled, feds in LA say](https://kesq.com/news/california/2026/09/01/russian-malicious-software-operation-dismantled-feds-in-la-say/)
- [Russian cybercrime operation being dismantled after two decades, US officials and CrowdStrike say](https://www.investing.com/news/stock-market-news/russian-cybercrime-operation-being-dismantled-after-two-decades-us-officials-and-crowdstrike-say-4884691)
- [Russian cybercrime operation being dismantled after two decades, US officials and CrowdStrike say](https://www.japantimes.co.jp/news/2026/09/02/world/russian-cybercrime-us-crowdstrike/)
- [CrowdStrike's Fal.Con 2026 Takes Over Mandalay Bay and Launches the Day Zero Threat Summit](https://www.crowdstrike.com/en-us/press-releases/falcon-2026-expands-to-mandalay-bay-launches-day-zero-summit/)
- [Sality Malware: Analysis, Detection, Removal](https://www.huntress.com/threat-library/malware/sality)
- [Sality (Wikipedia)](https://en.wikipedia.org/wiki/Sality)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2284