Minacce · 55 giorni fa
La rete Sality, attiva da 23 anni, è stata interrotta in un’operazione congiunta di forze dell’ordine e partner privati che ha tagliato il controllo degli operatori su oltre 15.000 macchine. Il punto non è solo il sequestro dell’infrastruttura: i difensori hanno sfruttato la fiducia del botnet nei propri peer per isolarlo dall’interno.
Sality accettava i peer della rete senza verificare chi fossero davvero. CrowStrike ha manipolato la peer list, rimosso i super peer e inserito sinkhole controllati dai difensori, così le macchine infette hanno smesso di trovare i nodi dell’operatore e hanno continuato a parlare solo con la controparte difensiva. Questo spezza la consegna di nuovi payload e il coordinamento centrale, ma non pulisce gli host già compromessi.
Per chi gestisce reti con infezioni Sality, la lezione è chiara: una botnet P2P può essere neutralizzata senza abbattere un C2 centrale, ma il parco macchine infetto resta un problema di bonifica. Finché gli host non vengono ripuliti, l’esposizione sopravvive anche dopo il sinkhole.
10 fonti che coprono questa storia
International Operation Disrupts Sality P2P Botnet
US-led action sinkholes machines caught up in Sality botnet
Government, industry partner to shut down long-running Sality botnet
A nonprofit group is now working to contact victims.
Dogged Russia-based botnet dismantled after 23-year run
Sality’s peer-to-peer infrastructure allowed it to evade system-wide disruption efforts for an exceptionally long period.
The Record from Recorded Future
Sality, one of the longest-running botnets, finally gets disrupted
and European authorities disrupted the long-running botnet Sality, turning the malware’s peer-to-peer architecture against itself to cut thousands of infected computers off from operators.
Global sinkhole operation ends Sality botnet’s 23-year run - Help Net Security
CrowdStrike and law enforcement led a disruption of Sality, a 23-year-old botnet that infected over 15,000 machines to steal cryptocurrency.
23-Year-Old Sality P2P Botnet Disrupted
The shutdown operation involved peer list manipulation and Sality payload URL takedown.
Authorities Turn Sality's P2P Network Against Itself, Cutting Off New Malware Payloads
Authorities sinkholed Sality's P2P botnet and seized linked domains, cutting off new payloads while existing malware remains active.
Sality botnet infrastructure dismantled in joint global takedown
International law enforcement agencies and private partners have seized Sality malware infrastructure in a joint action aiming to disrupt and take down the peer-to-peer (P2P) botnet.
Cops, CrowdStrike disrupt Sality botnet by poisoning the network and diverting into sinkholes
23-year-old botnet down
Inside the Sality Botnet Disruption Operation | CrowdStrike
CrowdStrike collaborated with international law enforcement and industry partners to execute a coordinated disruption of the Sality peer-to-peer botnet.
Part of the PlainSec briefing for 2026-09-04