Law Enforcement and Partners Dismantle 23-Year Sality Botnet
Summary
Law enforcement, CrowdStrike and Shadowserver dismantled the Sality peer-to-peer botnet, which infected more than 11 million devices over 23 years. CrowdStrike disrupted its peer list, and Shadowserver is helping identify infected devices for remediation.
Key points
- Sality infected more than 11 million devices during a 23-year period.
- The takedown involved law enforcement, CrowdStrike and the Shadowserver Foundation; Sality domains were seized.
- CrowdStrike said it targeted the botnet’s peer list to cut infected machines off from the network.
- Authorities said Sality enabled cryptocurrency theft and cyberattacks; CrowdStrike attributed three DDoS attacks to the botnet.
- Shadowserver is working with internet service providers to identify infected devices and support remediation.
- Officials did not identify the person or cybercrime group behind Sality.
Article Details
- Event Type
- Law-enforcement and private-sector takedown of the Sality botnet through infrastructure seizure and network disruption.
- Impact
- Sality infected more than 11 million devices over 23 years and was used for cryptocurrency theft, cyberattacks, and three DDoS attacks attributed to it by CrowdStrike. CrowdStrike said its disruption of the botnet’s peer list cut off infected devices and left the botnet no longer under operator control.
People
Malware
Vendors
Countries
BulgariaSality’s domains were seized by a globally coordinated effort supported by the FBI, Justice Department and authorities from Europol, Bulgaria, Hungary and Romania, officials said.HungarySality’s domains were seized by a globally coordinated effort supported by the FBI, Justice Department and authorities from Europol, Bulgaria, Hungary and Romania, officials said.RomaniaSality’s domains were seized by a globally coordinated effort supported by the FBI, Justice Department and authorities from Europol, Bulgaria, Hungary and Romania, officials said.RussiaSality, a Russia-based peer-to-peer botnet that infected more than 11 million devices over 23 years, has been dismantled by law enforcement, CrowdStrike, and the Shadowserver Foundation.United StatesThe botnet enabled cryptocurrency theft and cyberattacks on victims in the United States and abroad, the Justice Department said.