Sality Disrupted: The Takedown That Turned Its P2P Network Into a Trap

On August 31, 2026, the U.S. Department of Justice announced the disruption of the Sality botnet, active since 2003. The operation, coordinated by the FBI and DCIS with authorities in Bulgaria, Hungary, and Romania, exploited a structural vulnerability in the malware: the lack of authentication in the peer-to-peer protocol that underpinned its resilience. CrowdStrike and Shadowserver Foundation impersonated legitimate peers to drain the contact lists of infected bots and divert traffic to controlled sinkholes.

The Mechanism: How to Disrupt a Botnet Without Command Servers

Since 2003, Sality propagated as a Windows file infector, infecting executables on disk and spreading via network shares, USB drives, file-sharing platforms, compromised websites, email, and P2P networks. Unlike traditional botnets, it did not rely on a centralized command-and-control infrastructure. This absence of C2 made Sality technically impossible to take down using the classic server-seizure model.

The malware operated through two independent P2P networks, designated version 3 and version 4. According to CrowdStrike's technical writeup, they shared the same codebase but used incompatible protocols and cryptographic keys; both were managed by the same threat actor. Bots verified peer status every 40 minutes, accumulating or losing reputation over time.

The lack of authentication in the protocol made the operation possible. Sality bots accepted any peer that responded correctly to the P2P handshake, with no verifiable cryptographic identity or allowlist. As CrowdStrike documented, "anyone could join the network as a full participant with no way to distinguish it from a genuinely infected host." This characteristic allowed operators to insert themselves into the network as apparently legitimate peers.

"The same properties that made Sality resilient also created the conditions for its undoing"

Peer List Manipulation: The Technical Siege on the Infected Network

The technique at the heart of the operation is peer list manipulation, previously employed in 2014 against GameOver Zeus and in 2017 against Kelihos. The approach works by progressively replacing legitimate peers with operator-controlled nodes until bots are completely isolated from the authentic network.

The operation followed a two-phase sequence. Initially, operators targeted super peers — the network backbone — draining their contact lists and inserting sinkhole entries. They then adopted a passive approach for machines behind NAT or firewalls, which spontaneously contacted the new peers — in reality the sinkholes — during protocol maintenance cycles.

All infected machines now beacon to the IP address 188.166.101[.]148, identified by the source as the operation's "lighthouse." The seizure of Sality-linked domains in the United States and Europe completed the isolation, preventing the distribution of new payloads through the botnet's alternative channels.

EggJagger and the Economics of Cryptocurrency Theft

For the past eight years, the primary payload distributed by Sality has been EggJagger, a clipboard-hijacking tool designed to intercept and replace cryptocurrency wallet addresses copied by users. CrowdStrike estimates this payload generated at least $150,000 in theft for the threat actor.

Clipjacking represents an economically efficient form of attack: it does not require compromising exchanges or breaching private keys, but exploits human error in verifying pasted addresses. The impact remains significant for users even after the botnet's disruption, since malware already installed on machines remains functional and potentially capable of executing locally stored payloads.

Why It Matters

The dossier does not specify specific remediation measures for organizations, nor a systematic verification checklist. The source does not document the expected operational duration of the CrowdStrike sinkholes, the exact number of currently infected machines beyond payload distribution estimates, nor the threat actor's evolution toward other infrastructures.

What emerges clearly is the structural fragility of P2P botnets long considered inherently resilient. The lack of authentication, which eliminates traditional single points of failure, simultaneously introduces a protocol-level attack surface: the network itself becomes the disruption vector. Sality was not brought down by security failings of individual hosts, but by the absence of a trust model in its own communication mechanism.

The public-private collaboration model — DoJ, FBI, European agencies, CrowdStrike, and Shadowserver Foundation — offers an operational template for future actions against distributed infrastructures. Shadowserver's participation in victim notification via ISPs and national CSIRTs also represents a continuity element between the disruption action and the remediation phase, although the brief does not quantify the success rate of this phase.

Questions and Answers

Has Sality been removed from my computer?

No. The disruption prevents bots from receiving new payloads and isolates them from the P2P network, but the existing malware on infected machines "remains active and should be removed," according to CrowdStrike's statement in the cited source.

What risk does my company face if it has traffic to 188.166.101[.]148?

UDP traffic to this address indicates with high probability a machine infected with Sality beaconing to the operational sinkhole. The source explicitly recommends to "review network logs and endpoint telemetry for UDP traffic to the 'lighthouse' IP address," but does not specify automatic isolation or containment procedures.

Why is this takedown different from other botnet operations?

Traditional operations focus on centralized C2 infrastructure; this one exploited architectural characteristics of the target itself. Moreover, as a file infector, Sality "cannot be patched" — it receives no updates from a remote server but propagates by modifying executable files on disk, making disruption via sinkholing the only practical large-scale containment method.

Information is based on the cited advisory and current as of publication.

Sources

• https://thehackernews.com/2026/09/authorities-turn-salitys-p2p-network.html
• https://www.theregister.com/cyber-crime/2026/09/02/cops-crowdstrike-disrupt-sality-botnet-by-poisoning-the-network-and-diverting-into-sinkholes/5293795
• https://www.lawfuel.com/cyber-crime-sality-malware-disrupted-in-international-cyber-takedown-says-us-attorney/
• https://www.firstpost.com/tech/us-takes-down-sality-malware-network-in-global-cyber-crackdown-as-trump-administration-steps-up-defences-against-attacks-14042531.html
• https://nvd.nist.gov/vuln/detail/cve-2026-77846
• https://github.com/ash-project/ash_sqlite/commit/2138480fceb654bec1845e691517ac409d0232c3
• https://github.com/ash-project/ash_sqlite/security/advisories/GHSA-hrp2-5hgw-c83c
• https://cna.erlef.org/cves/CVE-2026-77846.html

Information is based on the cited source and current as of publication.

Sources