CrowdStrike, in collaboration with the U.S. Department of Justice, FBI, Defense Criminal Investigative Service, and law enforcement agencies from Bulgaria, Hungary, and Romania, dismantled the Sality peer-to-peer botnet that has been active since 2003, disconnecting over 15,000 infected devices from the network during a live demonstration.

For the past eight years, its primary payload has been the clipboard hijacking tool EggJagger, which replaces copied suspected Bitcoin or Ethereum addresses with the attacker's address, redirecting transfers when pasted. The company estimates that this alone has stolen at least 12.1 million rubles, approximately $150,000; unspent assets peaked at about 147 million rubles, nominally around $1.35 million, in January 2025. The operators have been tracked as SALTY SPIDER.

The botnet operates without a central server, spreading through peer-to-peer communication, local network sharing, and removable storage. Historically, it has also deployed credential theft, spam, proxy, and denial-of-service payloads, including attacks on Ukrainian websites on February 25, 2022, and a Russian cryptocurrency exchange in 2023. The Department of Justice stated that its lifecycle is associated with over 11 million unique IPs, peaking at controlling around 1 million devices; the current disconnection involves about 15,000 still under control.

On August 31, CrowdStrike's counteraction team executed a peer-to-peer sinkhole isolation, removing infected nodes from the original peer list. The U.S. authorities seized related domains within the country, while three European countries handled local hosting facilities. Shadowserver coordinated with operators and emergency response teams to notify device owners. The isolation does not disconnect already implanted programs, which must be cleaned by users to become ineffective.

The disconnection process was demonstrated at the Las Vegas Day Zero Summit. The U.S. Attorney's Office for the Central District of California issued an official statement. The scale of funds involved is much smaller than recent thefts from exchanges or traffic redirecting Trojan cases, but the duration spans two market cycles.

In market mechanics, the victims are self-managed users transferring addresses on personal computers, while the attackers rewrite the recipient at the device level, without touching on-chain contracts. The incident was driven by joint actions from law enforcement and security vendors, rather than market price fluctuations. Most stolen cryptocurrencies have not been spent, with balances fluctuating with coin prices; after cutting off the command channel, new thefts have ceased, but old wallets remain on-chain. Beneficiaries are endpoint security vendors and coordinating organizations that can notify infected hosts, while those under pressure are users relying on self-managed wallets who do not verify pasted addresses.

Source: Public Information