Law enforcement agencies in the U.S. and Europe have executed a successful operation to cripple the Sality botnet, a peer-to-peer (P2P) malware network active since 2003. On August 31, 2026, joint efforts by the U.S. Department of Justice, authorities in Bulgaria, Hungary, and Romania, and cybersecurity firms CrowdStrike and the Shadowserver Foundation severed the botnet’s ability to receive new payloads. Key Sality-linked domains were seized in both the U.S. and Europe as part of the coordinated initiative.
How the Botnet Worked — and How It Was Dismantled
Sality is a Windows-based malware strain that infects executable files and spreads via infected shares, USB drives, compromised websites, email attachments—and crucially—via a P2P network. This architecture made it resilient against traditional takedowns of command-and-control servers. Among its malicious tools is “EggJagger,” a clipper that monitors clipboard activity to swap in attacker-controlled cryptocurrency wallet addresses. At least $150,000 has been stolen using this method.
Authorities focused on Sality’s two active P2P networks (versions 3 and 4) that shared the same codebase but employed incompatible protocols and different cryptographic keys. These “super peers”—publicly reachable infected machines—formed the backbone of the P2P infrastructure.
The takedown hinged on an approach known as peer-list manipulation. Sality bots regularly maintain and verify their peer lists every 40 minutes, rewarding peers with reputation if they respond and dropping those who don’t. Because the system accepts any machine that responds to handshakes—without authenticating identity—investigators were able to remove legitimate super peers via manipulated verifications and inject sinkhole nodes into peer lists.
Sinkhole nodes—controlled by authorities—replace active nodes in the network, making infected machines believe they are still connected to the botnet infrastructure. This prevents them from receiving further payloads or updates. Machines behind NATs or firewalls, which can’t be directly reached, still connect to sinkhole nodes during their routine checks, gradually isolating them.
What Has Been Disrupted — and What Remains
With the peer-to-peer network sinkholed and Sality’s payload-hosting URLs seized, the malware can no longer download additional malicious components. A list of nine domains and URLs used to distribute payloads has been taken offline. Infected devices are now configured to contact CrowdStrike-controlled sinkholes. Security teams are advised to monitor network logs—especially UDP traffic to the “lighthouse” IP address 188.166.101.148—as an indicator of historic or ongoing Sality infection.
However, the disruption doesn’t clean infected machines; Sality instances already present continue executing locally until manually removed. The botnet’s propagation method—attaching to executables—means that patching or over-the-air updates were never part of its model.
This takedown aligns with recent efforts under the current Cyber Strategy for America aimed at disrupting hostile networks and degrading adversary infrastructure. It showcases how public-private partnerships, international cooperation, and deep technical understanding can overcome even highly resilient malware.
What this means: Sality’s defeat shows that even peer-to-peer malware—long considered difficult to neutralize—can be disrupted with clever protocol-level attacks. Moving forward, defenders must treat all networks—centralized or decentralized—with the same skepticism, recognizing that trust, authentication, and identity matter just as much as code or infrastructure. Watch for future operations that may target other legacy botnets using the same or related techniques.
