# Sality P2P Botnet Dismantled After 23 Years by CrowdStrike, FBI, DOJ, and a Europol-Led International Coalition

> CrowdStrike's Counter Adversary Operations team, working with the FBI, DOJ/DCIS, Europol, Eurojust, the Shadowserver Foundation, and authorities in Bulgaria, Hungary, and Romania, dismantled the Russia-based Sality peer-to-peer botnet on August 31, 2026 by poisoning its super-peer lists and seizing its domains. Active since 2003 and tied to more than 11 million infected IPs over its lifetime, Sality's last active payload, the EggJagger cryptocurrency clipper, stole at least $150,000 by hijacking clipboard wallet addresses before the takedown cut off its remaining ~15,000 infected machines from operator control.

- **Published:** 2026-09-02T00:00:00Z
- **Last reviewed:** 2026-09-02T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2303
- **ID:** TL-2026-2303
- **Severity:** MEDIUM
- **Category:** MALWARE
- **Status:** MONITORING
- **Actor:** SALTY SPIDER (Russia)
- **Detections:** 9 · **IOCs:** 18 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2017-0144

## Description

Sality is a polymorphic, Windows-executable-infecting virus first identified in 2003 and operated continuously for 23 years by an eCrime group CrowdStrike tracks as SALTY SPIDER (aliases: KuKu, SalLoad, Kookoo, SaliCode, Kukacka), assessed to be based in the Republic of Bashkortostan, Russia. After 2008 its original centralized model was superseded by advanced peer-to-peer (P2P) variants that removed any single command server an investigator could take down, and the botnet later split into two independent, cryptographically incompatible networks (v3 and v4) run by the same operator. A mid-2017 surge in infections coincided with exploitation of the EternalBlue SMBv1 vulnerability (CVE-2017-0144), the same flaw behind WannaCry and NotPetya, which CrowdStrike credits with driving new Sality infections. Historically, Sality-infected machines were monetized through credential theft, spam distribution, proxy services, and DDoS-for-hire capability; the botnet's DDoS function was weaponized at least three times: against the Arabic-language financial forum forex2030.com in April 2016, against the Ukrainian forum kharkovforum.com one day after Russia's February 2022 invasion of Ukraine (apparently to suppress military-related discussion), and against the Russian cryptocurrency exchange AvanChange in September 2023 using a payload compiled only seconds before deployment.

For roughly the past eight years, Sality's primary payload has been EggJagger, a clipboard-hijacking ('clipjacking') tool that silently monitors infected machines for copied Bitcoin and Ethereum wallet addresses and substitutes an attacker-controlled address, redirecting the victim's intended payment. CrowdStrike attributes at least ₽12.1 million (~$150,000 USD) in confirmed theft to EggJagger, with the operator's unspent cryptocurrency holdings peaking at roughly ₽147 million (~$1.35M nominal, ~$4M at Western purchasing-power parity) in January 2025 — notably, most of the stolen funds were never moved or cashed out.

On August 31, 2026, CrowdStrike executed what its researcher Tillmann Werner called the company's most complex botnet takeover to date. Sality's P2P protocol had no authentication or cryptographic identity verification, meaning any machine that correctly answered the P2P handshake was trusted and added to a bot's list of 'super peers' — the publicly reachable infected machines that form the network's backbone. Every bot re-verifies its super-peer list roughly every 40 minutes, dropping unresponsive entries. CrowdStrike exploited this maintenance cycle — a technique with precedent in the GameOver Zeus (2014) and Kelihos (2017) takedowns — to progressively remove legitimate super peers from bots' lists and inject sinkhole nodes in their place, cutting off URL/file-pack distribution to the wider network. For machines behind NAT/firewalls that could not be reached directly, the operation passively purged their peer lists whenever they contacted a sinkhole during a routine maintenance cycle. Simultaneously, the DOJ, FBI, and DCIS seized Sality-linked domains hosted in the U.S., while Bulgarian, Hungarian, and Romanian authorities seized additional domains hosted in Europe, with the Shadowserver Foundation working with ISPs to identify and support remediation of the remaining roughly 15,000 infected machines worldwide. No arrests or indictments were announced, and the SALTY SPIDER operators remain publicly unidentified.

## MITRE ATT&CK

- T1091 Replication Through Removable Media
- T1566.001 Spearphishing Attachment
- T1204.002 Malicious File
- T1554 Compromise Host Software Binary
- T1027 Obfuscated Files or Information
- T1685 Disable or Modify Tools
- T1014 Rootkit
- T1056.001 Keylogging
- T1555.003 Credentials from Web Browsers
- T1090 Proxy
- T1657 Financial Theft
- T1496 Resource Hijacking

## Sources

- [Dogged Russia-based botnet dismantled after 23-year run](https://cyberscoop.com/sality-botnet-dismantled/)
- [Inside the Sality Botnet Disruption Operation](https://www.crowdstrike.com/en-us/blog/inside-sality-botnet-disruption-operation/)
- [Cops, CrowdStrike disrupt Sality botnet by poisoning the network and diverting into sinkholes](https://www.theregister.com/cyber-crime/2026/09/02/cops-crowdstrike-disrupt-sality-botnet-by-poisoning-the-network-and-diverting-into-sinkholes/5293795)
- [Authorities Turn Sality's P2P Network Against Itself, Cutting Off Access](https://thehackernews.com/2026/09/authorities-turn-salitys-p2p-network.html)
- [Sality botnet infrastructure dismantled in joint global takedown](https://www.bleepingcomputer.com/news/security/sality-botnet-infrastructure-dismantled-in-joint-global-takedown/)
- [Sality, one of the longest-running botnets, finally gets disrupted](https://therecord.media/sality-botnet-cyber-doj)
- [Sality Malware: Analysis, Detection, Removal](https://www.huntress.com/threat-library/malware/sality)
- [Who is SALTY SPIDER (Sality)?](https://www.crowdstrike.com/en-us/blog/who-is-salty-spider/)
- [Salty Spider Adversary Profile](https://www.crowdstrike.com/en-us/adversaries/salty-spider/)
- [SALTY SPIDER (Threat Actor)](https://malpedia.caad.fkie.fraunhofer.de/actor/salty_spider)
- [Sality Botnet Dismantled After Eight Years of Stealing Bitcoin and Ethereum](https://decrypt.co/377156/sality-botnet-dismantled-after-eight-years-of-stealing-bitcoin-and-ethereum)
- [Sality Malware Disrupted in International Cyber Takedown](https://www.justice.gov/usao-cdca/pr/sality-malware-disrupted-international-cyber-takedown)
- [Sality P2P Botnet's Remarkable 23-Year Run Has Come to an End](https://securityboulevard.com/2026/09/sality-p2p-botnets-remarkable-23-year-run-has-come-to-an-end/)
- [A botnet running for 23 years with over 15,000 endpoints has finally been shut down](https://www.techradar.com/pro/security/a-botnet-running-for-23-years-with-over-15-000-endpoints-has-finally-been-shut-down-by-law-enforcement-and-crowdstrike)
- [Police take down 23-year-old Sality botnet](https://www.techzine.eu/news/security/144004/police-take-down-23-year-old-sality-botnet/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2303