Sality P2P Botnet Isolated After 20 Years via Super-Peer List Poisoning in Four-Nation Operation
Sality's disruption demonstrates that even mature P2P botnets can be dismantled through sustained list manipulation and cross-border domain seizures. The absence of arrests and limited public attribution evidence highlight the gap between operational success and traditional law-enforcement outcomes. Continued monitoring of legacy infections will test whether international cooperation scales to older malware families.
Authorities executed a peer-to-peer sinkhole by injecting false super-peer entries into the decentralized Sality network that has run since 2003. This severed command flow without a central server, cutting off EggJagger clipboard hijacks that CrowdStrike estimates stole at least $150,000 in cryptocurrency. Additional domains in the U.S. and Europe were seized to block payload retrieval. The operation required months of reverse-engineering because Sality's file-infector origins evolved into resilient direct bot-to-bot communication.
No arrests were announced despite CrowdStrike's geographic assessment of the operator. Official statements emphasize international cooperation yet omit that the botnet persisted for eight years on minimal overhead from a single actor. Independent verification of the $150,000 figure or additional revenue from spam and proxy services remains absent from public records. The pattern shows P2P designs extend lifespan but remain vulnerable once list-maintenance logic is mapped.
Shadowserver is now routing infection data to ISPs and national CSIRTs for owner notification. Re-infection risk stays high because legacy machines still provide initial footholds inside organizations. Future operations will likely target similar list or peer-discovery mechanisms rather than traditional C2 infrastructure.
Shadowserver: At least 8,000 owners contacted via national CSIRTs within 45 days of 15,000-bot isolation.
Sources (3)
- [1]Primary Source(https://therecord.media/sality-botnet-cyber-doj)
- [2]Supporting Source(https://www.crowdstrike.com/blog/sality-botnet-disruption/)
- [3]Supporting Source(https://www.shadowserver.org/news/sality-sinkhole/)