Threat reportMalwareTL-2026-2303
Sality P2P Botnet Dismantled After 23 Years by CrowdStrike, FBI, DOJ, and a Europol-Led International Coalition
Sality P2P Botnet Dismantled After 23 Years by CrowdStrike (TL-2026-2303) is a medium-severity malware campaign, first published 2026-09-02. It is attributed to SALTY SPIDER (Russia) with medium confidence, affects Microsoft Windows (portable executable / .exe files), references 1 CVE (CVE-2017-0144), maps to 12 MITRE ATT&CK techniques (T1014, T1027, T1056.001), and is covered by 9 detection rules and 18 indicators of compromise.
- Severity
- MEDIUMAssessed severity
- CVEs
- 1Referenced vulnerabilities
- Techniques
- 12MITRE ATT&CK
- Actors
- 1SALTY SPIDER
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 18Indicators of compromise
Key facts for TL-2026-2303
- Threat ID
- TL-2026-2303
- Severity
- MEDIUM
- Status
- MONITORING
- Category
- MALWARE
- First published
- Last reviewed
- Attribution
- SALTY SPIDER
- Attribution confidence
- MEDIUM
- Nation-state nexus
- Russia
- Motivation
- FINANCIAL
- Target sectors
- financial services, online forums and communities
- Target regions
- Global, romania, venezuela, ukraine, Middle East
- Detection rules
- 9
- Indicators of compromise
- 18
Malware and tooling in Sality P2P Botnet Dismantled After 23 Years by CrowdStrike
Malware and tooling: EggJagger, Sality, ETERNALBLUE
How Sality P2P Botnet Dismantled After 23 Years by CrowdStrike works
CrowdStrike's Counter Adversary Operations team, working with the FBI, DOJ/DCIS, Europol, Eurojust, the Shadowserver Foundation, and authorities in Bulgaria, Hungary, and Romania, dismantled the Russia-based Sality peer-to-peer botnet on August 31, 2026 by poisoning its super-peer lists and seizing its domains. Active since 2003 and tied to more than 11 million infected IPs over its lifetime, Sality's last active payload, the EggJagger cryptocurrency clipper, stole at least $150,000 by hijacking clipboard wallet addresses before the takedown cut off its remaining ~15,000 infected machines from operator control.
Sality is a polymorphic, Windows-executable-infecting virus first identified in 2003 and operated continuously for 23 years by an eCrime group CrowdStrike tracks as SALTY SPIDER (aliases: KuKu, SalLoad, Kookoo, SaliCode, Kukacka), assessed to be based in the Republic of Bashkortostan, Russia. After 2008 its original centralized model was superseded by advanced peer-to-peer (P2P) variants that removed any single command server an investigator could take down, and the botnet later split into two independent, cryptographically incompatible networks (v3 and v4) run by the same operator. A mid-2017 surge in infections coincided with exploitation of the EternalBlue SMBv1 vulnerability (CVE-2017-0144), the same flaw behind WannaCry and NotPetya, which CrowdStrike credits with driving new Sality infections. Historically, Sality-infected machines were monetized through credential theft, spam distribution, proxy services, and DDoS-for-hire capability; the botnet's DDoS function was weaponized at least three times: against the Arabic-language financial forum forex2030.com in April 2016, against the Ukrainian forum kharkovforum.com one day after Russia's February 2022 invasion of Ukraine (apparently to suppress military-related discussion), and against the Russian cryptocurrency exchange AvanChange in September 2023 using a payload compiled only seconds before deployment.
For roughly the past eight years, Sality's primary payload has been EggJagger, a clipboard-hijacking ('clipjacking') tool that silently monitors infected machines for copied Bitcoin and Ethereum wallet addresses and substitutes an attacker-controlled address, redirecting the victim's intended payment. CrowdStrike attributes at least ₽12.1 million (~$150,000 USD) in confirmed theft to EggJagger, with the operator's unspent cryptocurrency holdings peaking at roughly ₽147 million (~$1.35M nominal, ~$4M at Western purchasing-power parity) in January 2025 — notably, most of the stolen funds were never moved or cashed out.
On August 31, 2026, CrowdStrike executed what its researcher Tillmann Werner called the company's most complex botnet takeover to date. Sality's P2P protocol had no authentication or cryptographic identity verification, meaning any machine that correctly answered the P2P handshake was trusted and added to a bot's list of 'super peers' — the publicly reachable infected machines that form the network's backbone. Every bot re-verifies its super-peer list roughly every 40 minutes, dropping unresponsive entries. CrowdStrike exploited this maintenance cycle — a technique with precedent in the GameOver Zeus (2014) and Kelihos (2017) takedowns — to progressively remove legitimate super peers from bots' lists and inject sinkhole nodes in their place, cutting off URL/file-pack distribution to the wider network. For machines behind NAT/firewalls that could not be reached directly, the operation passively purged their peer lists whenever they contacted a sinkhole during a routine maintenance cycle. Simultaneously, the DOJ, FBI, and DCIS seized Sality-linked domains hosted in the U.S., while Bulgarian, Hungarian, and Romanian authorities seized additional domains hosted in Europe, with the Shadowserver Foundation working with ISPs to identify and support remediation of the remaining roughly 15,000 infected machines worldwide. No arrests or indictments were announced, and the SALTY SPIDER operators remain publicly unidentified.
MITRE ATT&CK techniques used in TL-2026-2303
Defense Evasion
T1014 Rootkit; T1027 Obfuscated Files or Information
Credential Access
T1056.001 Keylogging; T1555.003 Credentials from Web Browsers
Command and Control
Initial Access
T1091 Replication Through Removable Media; T1566.001 Spearphishing Attachment
Execution
Impact
T1496 Resource Hijacking; T1657 Financial Theft
Persistence
T1554 Compromise Host Software Binary
defense-impairment
Affected products and versions in Sality P2P Botnet Dismantled After 23 Years by CrowdStrike
- Microsoft — Windows (portable executable / .exe files)
Vulnerable versions: Any Windows host running unprotected/unpatched executables; hosts unpatched against MS17-010 (SMBv1/EternalBlue) were the primary vector for the 2017 infection surge
Fixed in: Not a single-product vulnerability — remediation is host reimaging plus MS17-010 patching / SMBv1 disablement
Remediation for Sality P2P Botnet Dismantled After 23 Years by CrowdStrike
Patches
- MS17-010 (addresses CVE-2017-0144 / EternalBlue) on any system still running SMBv1
Immediate actions
- Scan endpoints for Sality file-infector indicators (disabled/modified AV and firewall software, unexpected outbound P2P/UDP traffic, rapid unexplained corruption of executable files) and isolate any confirmed hosts
- Block outbound traffic to the known Sality v3/v4 payload-hosting domains and monitor for connections to the CrowdStrike/Shadowserver sinkhole IP (188.166.101.148) as a detection tripwire for lingering infections
- Reimage machines with confirmed Sality infection — Sality corrupts and embeds itself in legitimate executables, so manual disinfection is unreliable
Workarounds
- Disable SMBv1 entirely where MS17-010 cannot be applied
- Restrict/alert on outbound P2P-style UDP traffic from endpoints to unexpected external hosts
Longer-term hardening
- Deploy EDR capable of detecting polymorphic file-infector behavior and clipboard-substitution activity (EggJagger-style clipjacking)
- Patch MS17-010 / disable SMBv1 network-wide to remove the EternalBlue propagation vector CrowdStrike ties to Sality's 2017 resurgence
- Educate users handling cryptocurrency transactions to always visually verify the full destination wallet address after pasting, not just the first/last characters
CVEs associated with Sality P2P Botnet Dismantled After 23 Years by CrowdStrike
Timeline of Sality P2P Botnet Dismantled After 23 Years by CrowdStrike
- Sality is first identified as a centralized, polymorphic, Windows-executable-infecting virus; SALTY SPIDER begins operating it as a botnet.
- Sality's original centralized model is superseded by advanced peer-to-peer (P2P) variants, removing any single command server that investigators could take down.
- The Sality botnet is weaponized for a DDoS attack that renders the Arabic-language financial forum forex2030.com unresponsive.
- CrowdStrike observes a surge in Sality v3/v4 infections beginning summer 2017, coinciding with exploitation of the EternalBlue SMBv1 vulnerability (CVE-2017-0144).
- CrowdStrike Intelligence observes SALTY SPIDER distributing cryptocurrency-clipper malware via Sality, beginning what becomes roughly eight years of EggJagger as the botnet's primary payload.
- One day after Russia's invasion of Ukraine begins, Sality operators DDoS the Ukrainian discussion forum kharkovforum.com, apparently to suppress military-related discussion.
- Sality operators launch a DDoS attack against the Russian cryptocurrency exchange AvanChange using a payload compiled only seconds before deployment.
- EggJagger's unspent stolen-cryptocurrency holdings peak at approximately ₽147 million (~$1.35M nominal, ~$4M at purchasing-power parity); most of the funds are never cashed out.
- CrowdStrike, the FBI, DOJ/DCIS, Europol, Eurojust, Shadowserver, and Bulgarian, Hungarian, and Romanian authorities execute the coordinated takedown: peer-list poisoning isolates infected machines from Sality's P2P network while U.S. and European authorities seize Sality-linked domains.
- CrowdStrike, the DOJ, and law enforcement partners publicly announce the Sality botnet disruption; CrowdStrike researcher Tillmann Werner calls it the company's most complex botnet takeover to date.
Sources cited for Sality P2P Botnet Dismantled After 23 Years by CrowdStrike
- Dogged Russia-based botnet dismantled after 23-year run
- Inside the Sality Botnet Disruption Operation
- Cops, CrowdStrike disrupt Sality botnet by poisoning the network and diverting into sinkholes
- Authorities Turn Sality's P2P Network Against Itself, Cutting Off Access
- Sality botnet infrastructure dismantled in joint global takedown
- Sality, one of the longest-running botnets, finally gets disrupted
- Sality Malware: Analysis, Detection, Removal
- Who is SALTY SPIDER (Sality)?
- Salty Spider Adversary Profile
- SALTY SPIDER (Threat Actor)
- Sality Botnet Dismantled After Eight Years of Stealing Bitcoin and Ethereum
- Sality Malware Disrupted in International Cyber Takedown
- Sality P2P Botnet's Remarkable 23-Year Run Has Come to an End
- A botnet running for 23 years with over 15,000 endpoints has finally been shut down
- Police take down 23-year-old Sality botnet
Detection coverage for TL-2026-2303
As of 2026-09-02, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2303 across Splunk SPL, Microsoft KQL and Sigma, covering 18 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.