The U.S. Department of Justice announced the successful takedown of the Sality botnet, a peer-to-peer malware network that's been active since 2003, following a coordinated law enforcement operation on August 31, 2026. Authorities from the United States, Bulgaria, Hungary, and Romania worked together with private industry partners CrowdStrike and the Shadowserver Foundation to eliminate the threat. The operation used a peer-to-peer sinkhole approach to isolate infected machines from the threat actor's control, while simultaneously seizing Sality-linked domains in the U.S. and Europe.

The Sality botnet allowed its operator to distribute malicious payloads to more than 15,000 infected machines worldwide, according to CrowdStrike. Two independent P2P networks, designated version 3 and version 4, remained active until the disruption occurred, sharing the same codebase and operated by the same threat actor but using incompatible protocol versions and different cryptographic keys. One of the primary payloads delivered via Sality was EggJagger, a clipper tool that monitors a device's clipboard for cryptocurrency wallet addresses and replaces them with threat actor-controlled ones to redirect transactions. The threat actors are estimated to have stolen at least $150,000 using this method. The malware has been distributed through infected network shares, USB devices, file sharing, compromised websites, email attachments, and P2P networks, creating a self-propagating botnet that regenerates new infections without requiring any active efforts from the threat actor.

"Cybercriminals, botnets, and malware are a clear and present danger to our nation's security and economy," said First Assistant United States Attorney Bill Essayli. The malware is the work of a threat actor tracked by the cybersecurity community under the monikers Salty Spider, Kukacka, Sality, KuKu, SalLoad, Kookoo, and SaliCode, believed to be operating out of the Republic of Bashkortostan in Russia. Although Sality's operations are primarily driven by financial gain, CrowdStrike noted that the malware has been used to conduct three notable DDoS attack campaigns, targeting an Arabic Financial Forum in April 2016, a Ukrainian Forum in February 2022 (a day after Russia's full-scale invasion of Ukraine), and AvanChange in September 2023. According to the report, Sality features capabilities to infect and modify Windows executable files and spread additional malicious software designed for credential theft, spam distribution, proxy services, network exploitation, and distributed denial-of-service attacks.

The takedown operation leveraged a technique called peer list manipulation, which was also used in the 2014 GameOver Zeus and 2017 Kelihos botnet disruptions, according to CrowdStrike. The technique exploited the fact that Sality bots blindly trusted the P2P network without verifying who was added to it—as long as a machine was publicly reachable and responded correctly to the P2P handshake, it was accepted as a legitimate peer. This factor, coupled with the lack of authentication, cryptographic identity, or allowlist, meant that anyone could join the network as a full participant with no way to distinguish it from a genuinely infected host. The approach involves tampering with the peer list, a data structure containing a finite set of known super peers, which are publicly reachable infected machines that serve as the basis of the P2P network. The botnet checks whether its stored peers are still online every 40 minutes, and peers that respond accumulate reputation while those that fail lose reputation and are eventually purged. This maintenance cycle was abused to remove legitimate peers from the network via protocol-level manipulation during peer verification and insert purpose-built sinkhole entries into the emptied peer list. CrowdStrike explained that "the same properties that made Sality resilient also created the conditions for its undoing," noting that unlike conventional malware that can receive code updates from a C2 server, Sality's spreading mechanism is a file infector that propagated by attaching itself to executables on disk.

All Sality-infected machines are now configured to beacon to CrowdStrike-operated sinkholes, and organizations are recommended to review network logs and endpoint telemetry for UDP traffic to the "lighthouse" IP address 188.166.101[.]148. Any match indicates a Sality infection that requires remediation. The joint crackdown is one of the key pillars under President Donald Trump's Cyber Strategy for America, referred to as "Shape Adversary Behavior," which aims to identify and disrupt malicious networks, scale national capabilities, and alter adversary calculus by degrading their tools and infrastructure. CrowdStrike cautioned that while the disruption prevents new payloads from reaching infected machines, existing malware already installed on those systems remains active and should be removed. The operation demonstrates that peer-to-peer architecture, long considered a shield against disruption, isn't invincible when sufficient technical investment, precise understanding of protocol behavior, and coordination with law enforcement and industry partners are combined. The success of turning a decentralized network's own resilience mechanisms into its greatest vulnerability may embolden authorities to pursue similar campaigns against other botnets that have evaded traditional takedown methods. Whether this approach scales beyond networks with protocol weaknesses remains the critical question for defenders facing increasingly sophisticated adversaries.