Threats · 55 days ago
A joint law-enforcement and private-sector operation has disrupted Sality, the 23-year-old peer-to-peer botnet that had infected more than 15,000 machines and used to push payloads such as EggJagger and other malware. CrowdStrike and partners did it on Sept. 1 by sinkholing the network and removing super peers, while authorities also seized linked payload URLs.
The key was Sality’s own peer trust. Its bots accepted peer lists without authentication, so the takedown team could feed them poisoned entries, knock out legitimate super peers, and steadily isolate infected hosts from operator control. That cuts off new payload delivery and coordination, but it does not clean the Windows machines already running Sality.
For defenders, the lasting lesson is that a P2P botnet can be broken without seizing a central command server if its protocol can be manipulated. The exposure that remains is on the infected endpoints and any network that still has to find and clean them up.
10 sources covering this story
International Operation Disrupts Sality P2P Botnet
US-led action sinkholes machines caught up in Sality botnet
Government, industry partner to shut down long-running Sality botnet
A nonprofit group is now working to contact victims.
Dogged Russia-based botnet dismantled after 23-year run
Sality’s peer-to-peer infrastructure allowed it to evade system-wide disruption efforts for an exceptionally long period.
The Record from Recorded Future
Sality, one of the longest-running botnets, finally gets disrupted
and European authorities disrupted the long-running botnet Sality, turning the malware’s peer-to-peer architecture against itself to cut thousands of infected computers off from operators.
Global sinkhole operation ends Sality botnet’s 23-year run - Help Net Security
CrowdStrike and law enforcement led a disruption of Sality, a 23-year-old botnet that infected over 15,000 machines to steal cryptocurrency.
23-Year-Old Sality P2P Botnet Disrupted
The shutdown operation involved peer list manipulation and Sality payload URL takedown.
Authorities Turn Sality's P2P Network Against Itself, Cutting Off New Malware Payloads
Authorities sinkholed Sality's P2P botnet and seized linked domains, cutting off new payloads while existing malware remains active.
Sality botnet infrastructure dismantled in joint global takedown
International law enforcement agencies and private partners have seized Sality malware infrastructure in a joint action aiming to disrupt and take down the peer-to-peer (P2P) botnet.
Cops, CrowdStrike disrupt Sality botnet by poisoning the network and diverting into sinkholes
23-year-old botnet down
Inside the Sality Botnet Disruption Operation | CrowdStrike
CrowdStrike collaborated with international law enforcement and industry partners to execute a coordinated disruption of the Sality peer-to-peer botnet.
Part of the PlainSec briefing for 2026-09-04