Loading story…
CrowdStrike, international law enforcement agencies, and industry partners disrupted the long-running Sality peer-to-peer botnet by manipulating its peer-discovery mechanism. The operation reportedly removed legitimate super peers from bot peer lists and inserted sinkholes, severing the operator’s ability to distribute URL packs and file packs to compromised systems while allowing defenders to track infections. Partners also took down URLs hosting Sality payloads.
The disruption prevents affected Sality v3 and v4 bots from receiving new tasking, but it does not remove the malware or payloads previously delivered to infected endpoints. CrowdStrike published sinkhole IP addresses, URL indicators, and YARA rules to help organizations identify active infections and should be used alongside endpoint remediation to eradicate existing malware.
Pull IOCs and campaign context straight into your stack.
7 events from the most recent confirmed update back to the earliest known activity.
The Sality operator's never-spent cryptocurrency portfolio peaked at approximately ₽147 million, according to CrowdStrike's assessment.
A Sality DDoS payload targeted AvanChange, a Russian cryptocurrency exchange platform. The payload was compiled seconds before upload to distribution infrastructure, suggesting a possible impulsive personal grievance.
Sality distributed a DDoS payload against kharkovforum.com, a Ukrainian forum discussing Russia's military offensive against Kharkiv. CrowdStrike assessed the activity as likely patriotically motivated and apparently intended to suppress discussion of Russia's invasion of Ukraine.
A Sality DDoS payload targeted forex2030.com, an Arabic-language site covering natural-resource trading companies, and rendered the site unresponsive.
CrowdStrike identified 188.166.101.148 as a sinkhole lighthouse IP, with UDP traffic to it indicating a Sality infection requiring remediation. It also released URL-pack indicators and YARA rules CrowdStrike_Salityv3_01 and CrowdStrike_Salityv4_01 for detecting active infections.
The U.S. Justice Department, FBI, and Defense Criminal Investigative Service seized Sality-linked domains, while authorities in Bulgaria, Hungary, and Romania acted against additional domains hosted in Europe. The Shadowserver Foundation began supporting ISPs and CSIRTs with identifying infections, victim notification, and remediation.
CrowdStrike, international law enforcement, and industry partners disrupted the long-running Sality botnet by manipulating peer lists, removing legitimate super peers, and inserting sinkholes. The operation reportedly severed the operator's ability to communicate with infected hosts and coordinated takedowns of payload-hosting URLs.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 13 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
U.S., Bulgarian, Hungarian, and Romanian authorities, supported by CrowdStrike and the Shadowserver Foundation, disrupted the long-running **Sality** peer-to-peer botnet by seizing payload-hosting domains, dismantling control infrastructure, and sinkholing its super-peer network. The operation exploited Sality's unauthenticated peer-list protocol to redirect infected hosts away from operator-controlled infrastructure, cutting off delivery of new malware payloads and removing the botnet from the operators' control. Active since at least 2003, Sality infected more than 15,000 devices and spread by infecting Windows executables. CrowdStrike attributes the operation to **SALTY SPIDER**, a criminal group likely based in Russia's Republic of Bashkortostan; its infrastructure supported credential theft, spam, proxying, network exploitation, DDoS activity, and EggJagger cryptocurrency clipboard hijacking. Organizations should investigate UDP communications with `188.166.101[.]148`, an indicator of Sality infection, because sinkholing prevents new payload delivery but does not remove malware from already compromised systems.
Sep 4, 2026
An Operation Endgame action disrupted the **SocGholish** malware ecosystem by remediating **14,971 compromised websites** and dismantling associated command-and-control infrastructure, according to Orange Cyberdefense. SocGholish, a JavaScript-based downloader linked to the Russian-speaking initial access broker **TA569** and also tracked as **UNC1543**, **Mustard Tempest**, and **GOLD PRELUDE**, has compromised legitimate websites since at least 2017 and used fake browser update prompts to infect visitors. The malware has frequently served as an entry point for follow-on payloads including **Gholoader**, **MintsLoader**, **GhostWeaver**, **AsyncRAT**, **NetSupport RAT**, and ransomware operations such as **LockBit** and **RansomHub**. The disruption targeted a broader cybercrime chain tied to traffic distribution services such as **TA2726**, with reporting also noting copycat activity from **TA2727** distributing **Lumma** and **DeerStealer**, as well as links into the wider financially motivated ecosystem around **Evil Corp**. Defenders were warned that TA569 is likely to rebuild because SocGholish infrastructure rotates rapidly, often every **2 to 5 days**, making continued monitoring essential. Recommended mitigations included patching internet-facing CMS platforms, strengthening credentials, enabling **MFA**, and training users to distrust unsolicited browser update pop-ups that are commonly used as infection lures.
Jun 29, 2026
Polish security authorities, **CERT Polska**, Spamhaus, home.pl, Austrian CERT, and Group-IB collaborated to disrupt the **Virut** botnet by seizing or suspending command-and-control domains and redirecting traffic to sinkholes. The action targeted 23 `.pl` domains and additional infrastructure in `.ru`, cutting off a major portion of the malware’s control network. Virut, active since 2006, is a file-infecting worm and botnet that spreads through removable drives, network shares, and infected files, and at its peak was linked to hundreds of thousands of compromised systems. The disruption hit a malware platform that had been used for **pay-per-install** operations, including delivery of **ZeuS** and **Kehlios**, and had also been tied to broader criminal activity such as the re-emergence of the **Waledac** spam botnet. Researchers warned that the impact might be temporary because parts of Virut’s infrastructure remained outside Polish jurisdiction and the malware used a **domain generation algorithm (DGA)** that could allow operators to re-establish command and control if they registered newly generated domains. At the time, unresolved infrastructure in the `.at` namespace remained a notable holdout.
Aug 15, 2026