Investigators sinkholed Sality's peer list to strand more than 15,000 infected Windows hosts

The U.S. Department of Justice announced the takedown of the Sality P2P botnet; the operation was undertaken on August 31, 2026 by authorities from the U.S., Bulgaria, Hungary and Romania in collaboration with CrowdStrike and the Shadowserver Foundation, including a peer-to-peer sinkhole operation and seizure of Sality-linked domains in the U.S. and Europe.

The DOJ, FBI and DCIS seized Sality-linked domains in the United States, while law enforcement partners in Bulgaria, Hungary and Romania seized additional Sality-linked domains hosted in Europe.

The disruption was carried out with the DOJ, FBI, DCIS and the Shadowserver Foundation, with support from Europol, Eurojust and law enforcement agencies in Bulgaria, Hungary and Romania.

As long as a machine was publicly reachable and responded correctly to the P2P handshake it was accepted as a legitimate peer; Sality had no authentication, cryptographic identity or allowlist, so anyone could join the network.

EggJagger, a clipper or clipjacking tool, monitors the clipboard for cryptocurrency wallet addresses and substitutes attacker-controlled ones; the threat actors are estimated to have stolen at least $150,000 using this method.

For the past eight years the primary Sality payload has been EggJagger.

Sality has been documented in the wild since 2003 and infects and modifies Windows executable files, spreading additional malware for credential theft, spam distribution, proxy services, network exploitation and DDoS.

CrowdStrike says the Sality botnet is now no longer under the operator's control following the disruption.

Sality has been distributed through infected network shares, USB devices, file sharing, compromised websites, email attachments and P2P networks, creating a self-propagating botnet that regenerates new infections without any active effort from the threat actor.

CrowdStrike says Sality is controlled by a criminal group it tracks as SALTY SPIDER, likely operating out of the Republic of Bashkortostan in Russia.

CrowdStrike says Sality was used in three notable DDoS campaigns: against the Arabic Financial Forum (forex2030[.]com) in April 2016, a Ukrainian forum (kharkovforum[.]com) in February 2022, a day after Russia's full-scale invasion of Ukraine, and AvanChange in September 2023.

Two independent Sality P2P networks, known as version 3 and version 4, remained active until the disruption; CrowdStrike says they shared the same codebase and operator but used incompatible protocol versions and different cryptographic keys.

First Assistant United States Attorney Bill Essayli said the takedown shows that by working together the public and private sectors can be a powerful force for good.

CrowdStrike says Sality's P2P protocol cannot be patched because, unlike conventional malware that receives code updates from a C2 server, Sality's spreading mechanism is a file infector that propagates by attaching itself to executables on disk.

Sality had been operating for 23 years at the time of the disruption.

EggJagger theft amounts to roughly $10 per infected machine.

EggJagger theft averages roughly $18,750 per year over the eight years it has been the primary payload.

In July 2022 Dragos revealed a campaign that targeted industrial engineers and operators to seize control of programmable logic controllers and co-opt those devices into the Sality botnet.

In March, American and European authorities with private partners disrupted the SocksEscort proxy network and took down C2 infrastructure used by the Aisuru, KimWolf, JackSkid and Mossad botnets; in May Dutch authorities took a botnet of 17 million devices offline.