23-Year-Old Sality P2P Botnet Disrupted

Sality is a P2P botnet first observed in 2003, which propagated by infecting executable files and removable media. It distributed various malware, including information stealers and DDoS payloads, and was notably used to support the EggJagger clipjacking tool. Its decentralized architecture, lacking a central C&C server, allowed it to persist for over two decades. The botnet relied on a peer reputation system without authentication, which was exploited by CrowdStrike and law enforcement to manipulate peer lists and inject sinkholes, isolating infected machines from their controllers. Concurrently, URLs hosting Sality payloads were taken down by authorities in multiple countries. The infected machines now beacon to sinkholes operated by CrowdStrike, effectively disrupting the botnet's operation. The Shadowserver Foundation is collaborating with ISPs and CSIRTs to remediate infections.

The disruption operation has severed the communication between the Sality botnet operators and infected machines, neutralizing the botnet's ability to distribute malware or receive updates. This limits ongoing criminal activities facilitated by Sality, including malware distribution and cryptocurrency theft via EggJagger. The takedown reduces the threat posed by this long-standing botnet and aids in cleaning infected systems.

The botnet disruption is already in effect, isolating infected machines and removing control channels. No further immediate action is required to disrupt Sality. However, infected systems should be identified and cleaned, a process supported by The Shadowserver Foundation working with ISPs and CSIRTs. Organizations and individuals should ensure endpoint security solutions are updated and perform remediation on infected hosts as identified.