CrowdStrike and law enforcement disrupt Sality botnet active since 2003

September 2, 2026 at 07:25 PM1 min

This digest was compiled by AI from multiple sources — links to the originals are below.

CrowdStrike and international law enforcement disrupted Sality, a peer-to-peer botnet active since 2003 with over 15,000 endpoints. The operation sinkholed the botnet and removed payload URLs, cutting off its ability to deliver malware. The botnet had been used to deploy the clipboard hijacker EggJagger, which stole more than $150,000 in cryptocurrency.

Key Facts

Sality operated as a peer-to-peer botnet since 2003, with approximately 15,000 endpoints at the time of disruption.
Between 2018 and the disruption, Sality primarily deployed EggJagger, a clipboard hijacker used to steal cryptocurrency.
EggJagger alone generated more than $150,000 in stolen cryptocurrency for Sality's operators.
The operation was conducted with the US Department of Justice, FBI, DCIS, Shadowserver Foundation, Europol, Eurojust, and agencies in Bulgaria, Hungary, and Romania.

Botnet Disruption

CrowdStrike and law enforcement agencies sinkholed Sality's endpoints by injecting their own devices into the peer-to-peer network. When other bots attempted to communicate with these devices, the researchers purged their peer lists, effectively blinding them. CrowdStrike also coordinated with international law enforcement to take down URLs hosting the botnet's payloads. Disrupting Sality's ability to download files ensures that bots still carrying active URL packs cannot retrieve new payloads during the transition period.

EggJagger Cryptocurrency Theft

EggJagger monitors clipboard activity and replaces copied cryptocurrency wallet addresses with attacker-controlled addresses. When victims paste the address, funds are sent to the attacker's wallet instead of the intended recipient. CrowdStrike reported that Sality's operators earned more than $150,000 from EggJagger alone.