Sality botnet infrastructure dismantled in joint global takedown

The Sality botnet, a peer-to-peer malware network active since 2003, has been dismantled through a joint global operation involving Europol, Eurojust, the U.S. DOJ, FBI, DCIS, and private partners like CrowdStrike. The botnet infected over 15,000 devices and was used to distribute multiple malware families, including credential theft, spam, proxy services, network exploitation, and DDoS attacks. For the past eight years, its main payload was EggJagger, a clipjacking malware that replaces cryptocurrency wallet addresses copied to the clipboard with attacker-controlled addresses. The takedown included seizure of Sality-linked domains in the U.S. and Europe and sinkholing of the botnet's super peers to block payload propagation and purge infected machines' peer lists. CrowdStrike confirmed that the botnet is no longer under operator control, effectively neutralizing this long-standing threat.

The Sality botnet infected over 15,000 devices globally and was used to distribute a range of malware, including credential stealers, spam bots, proxy services, network exploitation tools, and DDoS attack capabilities. Its primary recent payload, EggJagger, targeted cryptocurrency users by silently replacing wallet addresses to divert funds. The takedown disrupts the botnet's ability to propagate malware and control infected devices, significantly reducing the threat posed by Sality and its operators. This action prevents further clipjacking attacks and other malicious activities previously enabled by the botnet.

The Sality botnet infrastructure has been dismantled and is no longer under operator control. No immediate action is required to mitigate this specific threat, as law enforcement and private partners have effectively neutralized the botnet through domain seizures and sinkholing operations. Organizations should continue standard malware detection and remediation practices to clean any remaining infections on their networks.