CrowdStrike and Law Enforcement Take Down Sality Botnet
CrowdStrike, in collaboration with the U.S. Department of Justice, FBI, Defense Criminal Investigative Service, and law enforcement agencies from Bulgaria, Hungary, and Romania, dismantled the Sality peer-to-peer botnet that has been active since 2003, disconnecting over 15,000 infected devices from the network during a live demonstration.
For the past eight years, its primary payload has been the clipboard hijacking tool EggJagger, which replaces copied suspected Bitcoin or Ethereum addresses with the attacker's address, redirecting transfers when pasted. The company estimates that this alone has stolen at least 12.1 million rubles, approximately $150,000; unspent assets peaked at about 147 million rubles, nominally around $1.35 million, in January 2025. The operators have been tracked as SALTY SPIDER.
The botnet operates without a central server, spreading through peer-to-peer communication, local network sharing, and removable storage. Historically, it has also deployed credential theft, spam, proxy, and denial-of-service payloads, including attacks on Ukrainian websites on February 25, 2022, and a Russian cryptocurrency exchange in 2023. The Department of Justice stated that its lifecycle is associated with over 11 million unique IPs, peaking at controlling around 1 million devices; the current disconnection involves about 15,000 still under control.
On August 31, CrowdStrike's counteraction team executed a peer-to-peer sinkhole isolation, removing infected nodes from the original peer list. The U.S. authorities seized related domains within the country, while three European countries handled local hosting facilities. Shadowserver coordinated with operators and emergency response teams to notify device owners. The isolation does not disconnect already implanted programs, which must be cleaned by users to become ineffective.
The disconnection process was demonstrated at the Las Vegas Day Zero Summit. The U.S. Attorney's Office for the Central District of California issued an official statement. The scale of funds involved is much smaller than recent thefts from exchanges or traffic redirecting Trojan cases, but the duration spans two market cycles.
In market mechanics, the victims are self-managed users transferring addresses on personal computers, while the attackers rewrite the recipient at the device level, without touching on-chain contracts. The incident was driven by joint actions from law enforcement and security vendors, rather than market price fluctuations. Most stolen cryptocurrencies have not been spent, with balances fluctuating with coin prices; after cutting off the command channel, new thefts have ceased, but old wallets remain on-chain. Beneficiaries are endpoint security vendors and coordinating organizations that can notify infected hosts, while those under pressure are users relying on self-managed wallets who do not verify pasted addresses.
Source: Public Information
ABAB AI Insight
Sality started in 2003 as a file infector, predating the Bitcoin mainnet, and later used the botnet as a rental pipeline for interchangeable payloads. Clipboard replacement became its main business, indicating the attackers' judgment: users have become accustomed to treating long addresses as copy-paste issues rather than verifying each time. CrowdStrike has labeled the adversary as SALTY SPIDER, opting for sinkholing rather than arrests to conclude the case, continuing the old method of dealing with peer-to-peer botnets—first disabling command, then cleaning hosts. California prosecutors, the FBI, Defense Investigators, and police from three European countries jointly turned a small-scale crypto theft into a cross-border infrastructure case.
Resource mobilization involved law enforcement seizing domains, vendors altering peer lists, and Shadowserver notifying operators. There has been no public statement about freezing that batch of wallets. The motivation for CrowdStrike is to demonstrate counteraction capabilities and serve the summit; for the Department of Justice, it is to erase the long-standing botnet attributed to Russia from the map. Strategically, $150,000 in principal plus a peak of $1.35 million does not constitute a national-level case, but the 23-year existence proves that a decentralized structure can withstand multiple rounds of attacks.
Comparable cases include GameOver Zeus, Emotet, Qakbot, and other botnets dismantled through sinkholing or prosecution, as well as recent independent Trojans targeting mnemonic phrases and clipboards. The main narrative of crypto crime has shifted towards exchanges, cross-chain bridges, and authorized phishing, while Sality remains at the personal computer level, indicating that old attack surfaces have not disappeared with the proliferation of hardware wallets. The industry phase is about law enforcement and vendors clearing the "still-living prehistoric networks" from inventory rather than chasing the latest zero days.
This is a combination of regulatory changes and technological substitution. The substitute is the payment habit of "copying is safe": once addresses can be rewritten by local programs, the irreversible nature of blockchain becomes a one-way loss. The mechanism is that peer-to-peer networks trust any node that completes a handshake, while defenders use the same protocol to replace the peer list with their own receivers. The regulatory layer provides cross-border seizures, and the technical layer provides isolation; without either, the 23-year-old network will continue to collect clipboard taxes.
ABAB News · Cognitive Laws
Irreversible settlement amplifies local errors.
Decentralized networks last long, but do not equate to high theft.
Cutting off command does not eliminate programs that have already entered.