Global sinkhole operation ends Sality botnet’s 23-year run
Sality, a peer-to-peer (P2P) botnet that had been running for 23 years and infecting more than 15,000 machines worldwide, has been taken down in a joint operation by international law enforcement agencies, working with CrowdStrike and the Shadowserver Foundation.
The operation cut Sality’s operator off from every infected machine still under their control.
Sality first appeared in 2003 as a file-infecting virus, the kind that attaches itself to executable programs and spreads whenever an infected file gets copied to a network share, a USB drive, or shared over a file-sharing network. Over time, its operator built it into two separate peer-to-peer networks, known internally as version 3 and version 4, that shared code but ran on incompatible protocols and different encryption keys.
“Throughout its history, Sality distributed a wide variety of distinct malware families spanning credential theft, spam distribution, proxy services, network exploitation, and distributed denial-of-service (DDoS) attacks,” CrowdStrike wrote in a technical writeup about the takedown.
For the past eight years, the main payload Sality delivered was a clipboard hijacker called EggJagger. It watches an infected machine for anything that looks like a cryptocurrency wallet address copied to the clipboard, then swaps it, without any prompt or warning, for an address the operator controls.
“When a victim copies a Bitcoin or Ethereum address to make a payment, the funds are redirected,” researchers noted.
CrowdStrike estimates the operator pulled in at least $150,000, through this method alone.
Sality wasn’t only used for profit. CrowdStrike documented three separate distributed denial-of-service campaigns launched through the botnet over the years, including one against a Ukrainian web forum on February 25, 2022, a day after Russia’s invasion began, and one against a Russian cryptocurrency exchange in 2023 that appeared to follow a personal dispute over a transaction.
Sality sinkhole operation targets the botnet’s backbone
The takedown centered on a sinkhole operation CrowdStrike’s Counter Adversary Operations team ran on Monday, coordinating with international law enforcement and other industry partners to disrupt Sality’s peer-to-peer network.
“In practice, the operation targeted the data structure at the heart of every bot’s network awareness: its peer list,” CrowdStrike stated.
Every Sality bot maintains a list of super peers, which are publicly reachable infected machines that form the backbone of the P2P network. Every 40 minutes, bots check whether their stored peers are still online. Researchers exploited this process to invalidate legitimate super peers and replace them with defender-controlled sinkholes.
Once isolated from legitimate peers, bots could no longer receive new instructions or malicious payloads from the operator.
Most infected machines were behind firewalls or NAT and could not be contacted directly, so researchers waited for them to connect to the sinkholes during their normal maintenance cycles. Their legitimate peer entries could then be purged, permanently isolating them from the operator’s network.
“This operation demonstrates that P2P architecture, long considered a shield against disruption, is not invincible. With sufficient technical investment, precise understanding of protocol behavior, and coordination with law enforcement and industry partners, even the most resilient criminal infrastructure can be dismantled,” CrowdStrike added.
Investigators in the US, Bulgaria, Hungary, and Romania also seized the domains hosting Sality’s payload files, closing off the remaining path any bot still holding old instructions might have used to fetch new malware during the transition.
The Shadowserver Foundation is coordinating with internet service providers and national computer security response teams to identify infected devices and notify their owners.
“Cybercriminals, botnets, and malware are a clear and present danger to our nation’s security and economy,” said First Assistant United States Attorney Bill Essayli. “This successful effort to take down the Sality botnet shows that by working together the public and private sectors can be a powerful force for good.”
