International operation disrupts Sality peer-to-peer botnet

Authorities in the United States, Bulgaria, Hungary and Romania disrupted the long-running Sality peer-to-peer botnet on August 31, 2026, isolating infected systems from the operator’s infrastructure. The coordinated action involved the U.S. Department of Justice, CrowdStrike and the Shadowserver Foundation, alongside the seizure of Sality-linked domains in the United States and Europe.

CrowdStrike said Sality had enabled its operator to distribute malicious payloads to more than 15,000 infected machines worldwide. Two active but incompatible P2P networks, identified as version 3 and version 4, used the same codebase while relying on different protocol versions and cryptographic keys.

Peer-to-peer resilience became the weak point

Sality has been observed since 2003 and infects Windows executable files. It can spread through infected network shares, USB devices, file-sharing services, compromised websites, email attachments and P2P networks. That file-infector model allowed the botnet to create fresh infections without an active distribution effort from its operator.

Some Sality variants communicated through P2P infrastructure rather than a conventional command-and-control server, making a standard server shutdown insufficient. The disruption instead exploited the protocol’s trust model. A publicly reachable machine that correctly responded to the P2P handshake could be accepted as a peer because the network lacked authentication, cryptographic identity and an allowlist.

Investigators used peer-list manipulation to replace legitimate peers with purpose-built sinkhole entries. Sality checks its stored peers every 40 minutes: responding peers gain reputation, while unavailable ones lose reputation and are eventually removed. The operation abused that maintenance process, first targeting publicly reachable super peers that form the network’s communication backbone.

Payload delivery halted, but infected hosts remain at risk

Once super peers were isolated, URL packs and file packs could no longer propagate. Systems behind firewalls or network address translation cannot normally be contacted directly, but they are isolated when they reach sinkhole nodes during their routine maintenance cycles and have their peer lists purged.

The authorities also removed URLs identified as Sality payload hosts. This blocks the malware from retrieving additional files and receiving download instructions. Sality’s P2P mechanism cannot be patched in the way conventional malware can receive code updates, because its propagation mechanism attaches itself to executables stored on disk.

One payload associated with Sality, EggJagger, monitors a device clipboard for cryptocurrency wallet addresses and replaces them with addresses controlled by the threat actor. CrowdStrike estimated that at least $150,000 was stolen through this technique. The botnet was also used in three notable DDoS campaigns, including attacks against the Arabic Financial Forum in 2016, the Ukrainian Forum in 2022 and AvanChange in 2023.

Detection and remediation remain necessary

All Sality-infected machines are now configured to beacon to CrowdStrike-operated sinkholes. CrowdStrike advised organizations to examine network logs and endpoint telemetry for UDP traffic to the lighthouse IP address 188.166.101[.]148; a match indicates a Sality infection requiring remediation.

The operation prevents new payloads from reaching affected machines, but malware already installed on those hosts remains active. For businesses, the practical next step is to investigate the identified beaconing traffic, contain affected endpoints and remove the existing infection rather than treating the infrastructure disruption as endpoint cleanup.