CrowdStrike-Led Operation Disrupts Sality P2P Botnet After Two Decades
Summary
CrowdStrike and international partners disrupted the Sality P2P botnet, which had infected more than 15,000 machines. Peer-list manipulation and sinkholing cut off tasking; existing infections remain active and require remediation.
Key points
- On August 31, 2026, CrowdStrike and international law enforcement and industry partners disrupted the Sality botnet, active since 2003.
- Sality operated two incompatible P2P networks, v3 and v4, and spread by infecting executable files shared across systems and removable drives.
- The operation invalidated legitimate peers and inserted sinkholes during bots’ peer-list maintenance, isolating infected machines from the operator.
- Authorities also took down URLs hosting payloads, preventing bots with active URL packs from retrieving new payloads.
- CrowdStrike says Sality’s EggJagger payload monitored copied cryptocurrency addresses and replaced them with addresses controlled by the operator.
- The disruption stops new tasking, but malware already installed remains active; CrowdStrike recommends checking network and endpoint telemetry and scanning with its YARA rules.
- UDP traffic to the listed lighthouse IP, 188.166.101[.]148, indicates a Sality infection requiring remediation.
Article Details
- Attack Vectors
- Sality spread by infecting executable files and propagating through network shares, removable drives, and file sharing.
- Sality used a peer-to-peer network to distribute URL packs and file packs containing additional payloads.
- EggJagger monitored clipboard contents for cryptocurrency wallet addresses and replaced them with addresses controlled by the operator.
- Sality-delivered DDoS payloads generated HTTP traffic against targeted websites.
- Defensive Notes
- Review network logs and endpoint telemetry for UDP traffic to 188.166.101[.]148; the article identifies a match as a Sality infection.
- Use the provided CrowdStrike_Salityv3_01 and CrowdStrike_Salityv4_01 YARA rules to scan running processes.
- Monitor for access attempts to the listed URL-pack URLs as evidence of Sality infection.
- Remove confirmed infections: the disruption blocks new payloads but does not remove malware already installed.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| URL | hxxp[:]//gatheredovertime[.]com/nb4 | Sality v3 URL-pack resource distributed for payload retrieval. |
| URL | hxxp[:]//highclass[.]atspace[.]com/styles.gif | URL-pack resource distributed by Sality bots for fetching payload instructions. |
| URL | hxxp[:]//imagebucket[.]biz/nv4 | Sality v4 URL-pack resource distributed for payload retrieval. |
| URL | hxxp[:]//painelwebradiodigital[.]awardspace[.]info/v3/readme.pdf | URL-pack resource distributed by Sality bots for fetching payload instructions. |
| URL | hxxp[:]//pozdravizbeograda[.]com/readme.pdf | URL-pack resource distributed by Sality bots for fetching payload instructions. |
| URL | hxxp[:]//sgwebdesigner[.]free[.]fr/left.gif | URL-pack resource distributed by Sality bots for fetching payload instructions. |
| URL | hxxp[:]//situluimihai[.]3x[.]ro/top.png | URL-pack resource distributed by Sality bots for fetching payload instructions. |
| URL | hxxp[:]//theunforgiven[.]p8[.]hu/img/top.gif | URL-pack resource distributed by Sality bots for fetching payload instructions. |
| URL | hxxp[:]//www[.]yonelco[.]com/icon.png | URL-pack resource distributed by Sality bots for fetching payload instructions. |
MITRE ATT&CK
T1027 · Obfuscated Files or InformationSality is described as a polymorphic file infector whose compiled payloads changed to evade static detection.T1091 · Replication Through Removable MediaSality spread through removable drives by attaching itself to executable files.T1095 · Non-Application Layer ProtocolSality used peer-to-peer communications and UDP beaconing to maintain botnet communications.T1105 · Ingress Tool TransferSality distributed additional payloads to infected machines through URL packs and direct file packs.T1115 · Clipboard DataEggJagger monitored clipboard contents for cryptocurrency wallet addresses.T1498 · Network Denial of ServiceSality distributed DDoS payloads that generated HTTP traffic to overwhelm targeted websites.T1657 · Financial TheftEggJagger redirected cryptocurrency payments to operator-controlled wallet addresses.
Threat Actors
Malware
EggJaggerSality had infected over 15,000 machines worldwide and was used to spread EggJagger, DDoS payloads, and other malware families for financial gain and targeted attacks.SalityCrowdStrike and international law enforcement disrupted the Sality P2P botnet, isolating infected machines and cutting off its ability to distribute payloads after more than two decades of operation.
Vendors
Tools
Countries
Bulgariaand the Shadowserver Foundation, with support from Europol, Eurojust, and law enforcement agencies in Bulgaria, Hungary, and Romania.HungaryShadowserver Foundation, with support from Europol, Eurojust, and law enforcement agencies in Bulgaria, Hungary, and Romania.RomaniaFoundation, with support from Europol, Eurojust, and law enforcement agencies in Bulgaria, Hungary, and Romania.RussiaUkrainian Forum Attack (February 2022): On February 25, 2022, one day after Russia’s full-scale invasion of Ukraine, Sality distributed a DDoS payload targeting kharkovforum[.]com, a Ukrainian web forum hosting a threadUkraineForum Attack (February 2022): On February 25, 2022, one day after Russia’s full-scale invasion of Ukraine, Sality distributed a DDoS payload targeting kharkovforum[.]com, a Ukrainian web forum hosting a thread