> ## Content Index
> Fetch the complete content index at: https://www.thecybersignal.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# DOJ and CrowdStrike Disrupt Sality, the 23-Year-Old P2P Botnet, by Poisoning Its Own Peer List
- URL: https://www.thecybersignal.com/doj-crowdstrike-sality-23-year-p2p-botnet-takedown-2026/
- Published: 2026-09-02T18:22:00.000Z
- Updated: 2026-09-02T23:48:43.000Z
- Description: Authorities turned Sality's peer-to-peer design against itself, injecting sinkholes into the botnet's own peer lists to cut more than 15,000 infected machines off from their operator. The disruption stops new payloads, but already-infected Windows hosts still need cleanup.
- Author: Nicholas Robert
- Tags: Law Enforcement, Malware & Threat Intel, Global Cooperation

American and European authorities have disrupted Sality, one of the internet's longest-running botnets, after 23 years of operation. Working with the cybersecurity firm CrowdStrike and the nonprofit Shadowserver Foundation, investigators turned the malware's peer-to-peer (P2P) architecture against itself, poisoning the network's own address books to cut more than 15,000 infected machines off from their operator. The US Department of Justice (DOJ) [announced](https://www.justice.gov/usao-cdca/pr/sality-malware-disrupted-international-cyber-takedown?ref=thecybersignal.com) the takedown on September 2, 2026, crediting CrowdStrike and its partners with executing a peer-to-peer sinkhole operation.

The disruption matters for defenders in a specific way: it does not automatically clean the infected machines. As [The Hacker News reported](https://thehackernews.com/2026/09/authorities-turn-salitys-p2p-network.html?ref=thecybersignal.com), new payloads can no longer reach the botnet, but the malware already sitting on those 15,000-plus Windows hosts stays active until someone removes it. That leaves the cleanup work squarely with the organizations that own the endpoints.

## What the Takedown Actually Did

The operation did two things at once: it isolated infected machines from one another, and it seized the web addresses that fed them fresh malware. Both halves aimed at the same result, severing the operator's control.

Unlike a botnet built around a central command-and-control (C&C) server, Sality relied on infected computers talking directly to each other. Each bot keeps a list of publicly reachable machines called super peers that relay information across the network. Every 40 minutes, according to [Help Net Security](https://www.helpnetsecurity.com/2026/09/02/sality-botnet-disruption-crowdstrike-law-enforcement/?ref=thecybersignal.com), a bot checks whether its stored peers are still online, promoting the ones that answer and purging the ones that do not. CrowdStrike's Counter Adversary Operations team abused that maintenance cycle: it invalidated the legitimate super peers and slid its own sinkholes into the emptied lists. Machines behind firewalls or network address translation could not be contacted directly, so researchers waited for them to check in during their normal cycle, then purged their peer entries and left them permanently isolated.

In parallel, law enforcement in the United States, Bulgaria, Hungary, and Romania seized the domains that hosted Sality's payload files, closing the last path a bot might have used to fetch new malware during the transition. [SecurityWeek](https://www.securityweek.com/23-year-old-sality-p2p-botnet-disrupted/?ref=thecybersignal.com) described the two prongs plainly: peer list manipulation to isolate the bots, and payload URL takedown to starve them. CrowdStrike put the outcome bluntly in its [technical writeup](https://www.crowdstrike.com/en-us/blog/inside-sality-botnet-disruption-operation/?ref=thecybersignal.com): "This operation demonstrates that P2P architecture, long considered a shield against disruption, is not invincible."

## Why a Peer-to-Peer Botnet Was Supposed to Resist Takedown

A decentralized botnet has no single server to seize or redirect, which is exactly what normally makes sinkholing fail. Take down one server on a conventional botnet and the whole thing goes dark. Sality had no such chokepoint, because every infected machine could route around any loss.

The counter is not new, but it is hard. Peer list manipulation was also used against the [GameOver Zeus botnet in 2014 and Kelihos in 2017](https://thehackernews.com/2026/09/authorities-turn-salitys-p2p-network.html?ref=thecybersignal.com), and it works because these networks trust any machine that speaks the protocol correctly. Sality had no authentication, no cryptographic identity check, and no allowlist, so anyone who answered the handshake was accepted as a full peer. CrowdStrike researcher Tillmann Werner [told Reuters](https://therecord.media/sality-botnet-cyber-doj?ref=thecybersignal.com) the disruption required extensive reverse engineering and was the most complex botnet takeover the company had ever run. Two separate P2P networks, known internally as version 3 and version 4, sharing a codebase but running incompatible protocols and different cryptographic keys, both had to be neutralized.

## Sality's Longevity Is the Real Story

Sality is old, and its age is the point. It first appeared in 2003 as a virus that infected Windows executable files, spreading whenever a compromised file was copied to a network share, a USB drive, or a file-sharing service. Over two decades it grew into a P2P botnet that distributed malware for credential theft, spam, proxy services, network exploitation, and distributed denial-of-service (DDoS) attacks.

For roughly the past eight years, its main payload was EggJagger, a clipboard hijacker that watches for cryptocurrency wallet addresses and silently swaps a copied address for one the operator controls. If a victim does not notice the substitution before confirming a transaction, the funds go to the attacker. CrowdStrike estimates the operator stole at least $150,000 in Bitcoin and Ethereum through this technique alone. The botnet was not only a moneymaker: CrowdStrike documented three DDoS campaigns launched through it over the years, including one against a Ukrainian web forum on February 25, 2022, the day after Russia's invasion began.

The recurring lesson from these operations is that dismantling the infrastructure and cleaning the endpoints are two different jobs. Recent CyberSignal coverage shows the pattern: the [GlassWorm takedown by CrowdStrike, Google, and Shadowserver](https://www.thecybersignal.com/glassworm-botnet-takedown-crowdstrike-google-shadowserver-solana-c2-2026/) hit multiple command channels at once, the [Dutch dismantling of the Asocks residential proxy botnet](https://www.thecybersignal.com/dutch-politie-ncsc-asocks-residential-proxy-takedown-17-million-devices-2026/) reached 17 million devices, and Canada's spy agency used a [first-of-its-kind warrant to clean botnet-infected devices](https://www.thecybersignal.com/csis-canada-first-of-its-kind-botnet-warrant-2026/) directly. In each case the disruption is the headline, and the residual infections are the follow-up nobody sees.

## Why a Decades-Old Infection Still Bites

An old infection is still a live foothold, which is why this matters beyond the crypto theft. David Watson, a director at the Shadowserver Foundation, [told Reuters](https://therecord.media/sality-botnet-cyber-doj?ref=thecybersignal.com) that Sality was old-school but stayed dangerous, because a compromised machine can still hand an attacker a foothold inside an organization. Even with new payloads cut off, a resident file infector is an unmanaged execution path sitting on your network, and the operator has not been arrested. Sinkholing bought defenders time, not a cure.

The reach also went past ordinary desktops. In July 2022, the industrial-security firm Dragos [documented a campaign](https://thehackernews.com/2026/09/authorities-turn-salitys-p2p-network.html?ref=thecybersignal.com) that targeted industrial engineers and operators to seize programmable logic controllers and pull them into the botnet, per The Hacker News. And because Sality spreads through infected executables, network shares, and USB media, it regenerates new infections with no active effort from the operator. That self-propagation is how a 23-year-old threat kept refilling its own ranks while nobody was watching, and it is why a single overlooked host can undo a cleanup.

## What Defenders Should Do Now

If you run Windows endpoints, especially older or long-unpatched ones, treat this as a prompt to check for a decades-old infection you may never have noticed. Shadowserver is already working with internet service providers and national response teams to identify still-infected systems and notify their owners, so a notification may reach you. Do not wait for it. The single most useful published indicator: CrowdStrike says all Sality-infected machines now beacon to its sinkholes, and organizations should review network logs and endpoint telemetry for UDP traffic to the lighthouse address 188.166.101\[.\]148\. Any match indicates a Sality infection that needs remediation.

Because Sality spreads as a file infector, cleanup is not a one-click job. A single missed executable can reinfect a machine you just cleaned, which is why endpoint remediation here follows the same discipline as any malware outbreak. For the underlying method, see our guide to [incident response](https://www.thecybersignal.com/incident-response-the-complete-guide/). The checklist below covers the concrete steps.

| ● Sality Cleanup ChecklistWhat to do if a Windows host may have been part of the botnet                                                                                                                  |
| -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Scan for Sality SignaturesRun current endpoint protection across the Windows estate. Sality is a file infector, so one missed executable can reinfect a cleaned machine.                                 |
| Hunt the Published IOCsReview network logs and endpoint telemetry for UDP traffic to CrowdStrike’s sinkhole lighthouse at 188.166.101\[.\]148\. A match means an infected host.                          |
| Remediate, Do Not Trust the SinkholeSinkholing stops new payloads, but malware already installed stays active. Reimage or fully clean affected hosts rather than assuming the disruption did it for you. |
| Patch or Retire Long-Unpatched Windows HostsSality thrives on old machines and removable media. Update or decommission the hosts that never got attention.                                               |
| Segment and Monitor Legacy MachinesIsolate systems you cannot fully patch, restrict USB and share access, and watch them for the beacon above.                                                           |
| Source: CrowdStrike Counter Adversary Operations and the US Department of Justice, September 2026.                                                                                                       |

Defender checklist for responding to a possible Sality infection. Source: CrowdStrike and the US Department of Justice, September 2026.

## What Is Not Confirmed

Several details remain open. No arrests were announced, and authorities have not publicly named the operator. The Record reports that CrowdStrike assesses the group operates from the Bashkortostan region of Russia, but that is an attribution assessment, not a confirmed identity, and it currently rests on a single source. Authorities have also not published a country-by-country breakdown of where the 15,000-plus infected machines sit, so the geographic distribution of the victims is unconfirmed. What is confirmed is the roster of named partners: the DOJ, the FBI, CrowdStrike, and European law enforcement in Bulgaria, Hungary, and Romania, alongside the Shadowserver Foundation.

**My read:** The clever part is not the arrest, because there was not one. It is that a botnet built to survive server seizures was undone by its own trust model. Sality accepted any peer that spoke the protocol, so defenders became peers and quietly rewrote the network's address book. That is an elegant counter to an architecture the field long treated as takedown-resistant. But the durable lesson is the 23 years. Something this old, this quiet, and this persistent survived because it lived on the machines nobody was looking at. The disruption is a genuine win. Whether it holds depends on how many of those forgotten Windows hosts actually get cleaned, and that part is on defenders, not the DOJ.

**Primary documents**

- [US Department of Justice: Sality Malware Disrupted in International Cyber Takedown](https://www.justice.gov/usao-cdca/pr/sality-malware-disrupted-international-cyber-takedown?ref=thecybersignal.com)
- [CrowdStrike: Inside the Sality Botnet Disruption Operation](https://www.crowdstrike.com/en-us/blog/inside-sality-botnet-disruption-operation/?ref=thecybersignal.com)