Sality's P2P Network Turned Against Itself, Cutting Off New Malware Payloads

Sality is a long-standing Windows-based botnet that infects executables to propagate malware for various malicious activities including credential theft, spam, and distributed denial-of-service (DDoS) attacks. It also distributed the EggJagger clipper malware, which conducted cryptocurrency wallet address substitution to steal funds. On August 31, 2026, a multinational law enforcement coalition, working with private cybersecurity organizations, successfully disrupted Sality by exploiting its peer-to-peer (P2P) architecture. By manipulating the botnet's peer lists—injecting sinkhole peers and removing legitimate ones—they isolated over 15,000 infected hosts from the threat actors controlling the botnet. This peer list manipulation effectively cut off the delivery of new malware payloads. Additionally, associated malicious domains were seized across the U.S. and Europe. While this operation halts new infections and payload distribution, it does not remove existing infections, which still require active remediation by affected users or organizations.

The disruption of Sality's P2P network prevents the delivery of new malware payloads, effectively halting the botnet's expansion and new malicious activities. However, existing infections remain active on compromised machines, continuing to pose risks such as credential theft, spam distribution, and participation in DDoS attacks. The botnet had previously caused financial losses through EggJagger clipper malware, stealing at least $150,000 via cryptocurrency wallet substitution. The takedown reduces ongoing criminal operations and limits further financial and operational impact from this botnet.

The takedown operation has disrupted Sality's ability to distribute new payloads by manipulating its P2P network and seizing associated domains. However, existing infections remain active and require remediation. Affected users and organizations should identify and clean infected systems using appropriate anti-malware tools and incident response procedures. There is no software patch applicable since this is a botnet infection rather than a software vulnerability. Continued monitoring and remediation of infected hosts are necessary to fully eliminate the threat.