Loading malware…
Sality is a Windows polymorphic file-infecting malware family and botnet first observed in 2003. It infects executable files and propagates through network shares, removable drives, and file-sharing systems. Originally associated with centralized command and control, it evolved into a decentralized peer-to-peer network in which infected computers exchange commands, updates, and payload-delivery information. Publicly reachable infected systems act as super peers, providing a communications backbone without a single central point of failure.
Sality primarily functions as a platform for delivering additional malware. Its payloads have supported credential theft, spam distribution, proxy services, network exploitation, and distributed denial-of-service attacks. Sality has also been used directly in occasional DDoS campaigns. In its later years, its principal payload was EggJagger, a separate cryptocurrency clipboard hijacker that replaces copied wallet addresses with attacker-controlled addresses. CrowdStrike tracks the financially motivated actor developing and maintaining Sality as SALTY SPIDER. Infections have affected systems worldwide, including legacy operational technology environments; Sality is not confined to a particular industry.
An international operation disrupted Sality on August 31, 2026. CrowdStrike and partners exploited its unauthenticated peer-trust mechanism to manipulate peer lists and redirect infected systems to defender-controlled sinkholes, while authorities seized associated domains and removed payload-hosting infrastructure. The operation interrupted operator communications and additional payload delivery but did not remove Sality or previously delivered malware from compromised endpoints.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
2 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
The worm exploits the CVE-2010-2568 vulnerability... When a user tries to open an infected USB flash drive with an application that can display icons for shortcuts, the file with the name ~WTR4141.TMP is loaded and its entry point is called. | A number of new malware families were identified using same vulnerability in late July, and a number of other families such as Win32/Sality generated new variants that also used it.
Dragos researchers determined it did not crack the password at all, rather, it exploited a vulnerability in the firmware which allowed it to retrieve the password on command... This vulnerability was assigned CVE-2022-2003 and was responsibly disclosed to Automation Direct. They have released a firmware update to fix this issue. | the software was a malware dropper, infecting the machine with the Sality malware and turning the host into a peer in Sality’s peer-to-peer botnet.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
SALTY SPIDER develops and maintains a botnet known as Sality that is a polymorphic file infector linked to an advanced peer-to-peer (P2P) botnet. The original centralized version of Sality goes back to at least 2003.
17 distinct techniques documented for this family, organized by ATT&CK tactic.
Sality also spread by attaching itself to executable files and moving through network shares, removable drives, and file-sharing systems.
It attached malicious code to executable files and could spread through network shares, removable drives and file-sharing systems.
Seized domains “had served as fallback infrastructure that infected systems could have used to fetch new malicious payloads even after the botnet’s core communication network was severed.”
La section « TTPs et IOCs détectés » liste « T1071.001 — Application Layer Protocol: Web Protocols (Command and Control) ».
During its long history, Sality distributed malware associated with credential theft, spam, proxy services, network exploitation and distributed denial-of-service attacks.
La section « TTPs et IOCs détectés » liste « T1090.001 — Proxy: Internal Proxy (Command and Control) ».
21 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
44 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Identified as a legacy infection increasingly encountered in operational technology networks. The article does not describe Sality-specific capabilities; it emphasizes that repeated legacy infections can consume scarce system resources and destabilize aging industrial computers, while cleanup requires operational risk assessment.
A decentralized peer-to-peer botnet whose infected devices communicate directly using trusted-peer lists rather than a central command-and-control server. It was used to distribute payloads supporting cryptocurrency theft, spam, network exploitation, and distributed denial-of-service attacks. The disruption severed operator communications with more than 33,000 infected devices, but did not remove the malware or any delivered secondary payloads from endpoints.
A long-running peer-to-peer botnet that infects executable files and propagates through network shares, removable drives, and file-sharing systems. Its decentralized architecture used unauthenticated super peers and was disrupted through defender-controlled peer-list manipulation and sinkholing. It was used to distribute secondary malware and occasionally conduct DDoS attacks.
The referenced item concerns an international cyber takedown targeting Sality malware.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.