Loading story…
U.S., Bulgarian, Hungarian, and Romanian authorities, supported by CrowdStrike and the Shadowserver Foundation, disrupted the long-running Sality peer-to-peer botnet by seizing payload-hosting domains, dismantling control infrastructure, and sinkholing its super-peer network. The operation exploited Sality's unauthenticated peer-list protocol to redirect infected hosts away from operator-controlled infrastructure, cutting off delivery of new malware payloads and removing the botnet from the operators' control.
Active since at least 2003, Sality infected more than 15,000 devices and spread by infecting Windows executables. CrowdStrike attributes the operation to SALTY SPIDER, a criminal group likely based in Russia's Republic of Bashkortostan; its infrastructure supported credential theft, spam, proxying, network exploitation, DDoS activity, and EggJagger cryptocurrency clipboard hijacking. Organizations should investigate UDP communications with 188.166.101[.]148, an indicator of Sality infection, because sinkholing prevents new payload delivery but does not remove malware from already compromised systems.
Pull IOCs and campaign context straight into your stack.
8 events from the most recent confirmed update back to the earliest known activity.
The U.S. Department of Justice announced the coordinated Sality disruption. CrowdStrike assessed that the operation removed the botnet from operator control, although sinkholing does not remove malware already installed on infected systems.
Authorities in the United States, Bulgaria, Hungary, and Romania, supported by CrowdStrike and the Shadowserver Foundation, conducted a coordinated disruption of Sality. The operation seized Sality-linked domains and used peer-list manipulation and sinkholes to isolate infected hosts, remove super peers, and block payload transfers and download instructions.
Sality targeted AvanChange in a distributed denial-of-service attack.
Dragos reported that a Sality campaign targeted industrial engineers and operators in an effort to take control of programmable logic controllers and enlist them in the botnet.
Sality targeted the Ukrainian Forum website kharkovforum[.]com in a DDoS attack, one day after Russia's full-scale invasion of Ukraine.
Sality targeted the Arabic Financial Forum website forex2030[.]com in a distributed denial-of-service attack.
Sality was observed in the wild and active by 2003, infecting and modifying Windows executable files and using multiple propagation methods.
CrowdStrike attributed Sality to the SALTY SPIDER group, which it assesses operates from Russia's Republic of Bashkortostan. It said Sality had primarily delivered the EggJagger cryptocurrency clipper for the prior eight years and that operators stole at least $150,000 in cryptocurrency.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 9 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
20 references tracked. Mallory keeps watching after this page renders.
techrepublic.com
Open sourceinfosec.pub
Open sourcecysecurity.news
Open sourcexakep.ru
Open sourcecyberveille.ch
Open sourcejustice.gov
Open sourcecrowdstrike.com
Open sourceeuropol.europa.eu
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
CrowdStrike, international law enforcement agencies, and industry partners disrupted the long-running **Sality** peer-to-peer botnet by manipulating its peer-discovery mechanism. The operation reportedly removed legitimate super peers from bot peer lists and inserted sinkholes, severing the operator’s ability to distribute URL packs and file packs to compromised systems while allowing defenders to track infections. Partners also took down URLs hosting Sality payloads. The disruption prevents affected Sality v3 and v4 bots from receiving new tasking, but it does not remove the malware or payloads previously delivered to infected endpoints. CrowdStrike published sinkhole IP addresses, URL indicators, and YARA rules to help organizations identify active infections and should be used alongside endpoint remediation to eradicate existing malware.
Sep 2, 2026
An Operation Endgame action disrupted the **SocGholish** malware ecosystem by remediating **14,971 compromised websites** and dismantling associated command-and-control infrastructure, according to Orange Cyberdefense. SocGholish, a JavaScript-based downloader linked to the Russian-speaking initial access broker **TA569** and also tracked as **UNC1543**, **Mustard Tempest**, and **GOLD PRELUDE**, has compromised legitimate websites since at least 2017 and used fake browser update prompts to infect visitors. The malware has frequently served as an entry point for follow-on payloads including **Gholoader**, **MintsLoader**, **GhostWeaver**, **AsyncRAT**, **NetSupport RAT**, and ransomware operations such as **LockBit** and **RansomHub**. The disruption targeted a broader cybercrime chain tied to traffic distribution services such as **TA2726**, with reporting also noting copycat activity from **TA2727** distributing **Lumma** and **DeerStealer**, as well as links into the wider financially motivated ecosystem around **Evil Corp**. Defenders were warned that TA569 is likely to rebuild because SocGholish infrastructure rotates rapidly, often every **2 to 5 days**, making continued monitoring essential. Recommended mitigations included patching internet-facing CMS platforms, strengthening credentials, enabling **MFA**, and training users to distrust unsolicited browser update pop-ups that are commonly used as infection lures.
Jun 29, 2026
VMRay Labs detailed **Operation STANDOFF**, a previously unattributed Russian-speaking cybercriminal campaign that delivers multiple payloads through a pay-per-install `NSIS` loader masquerading as `setup_x86_x64_install.exe`. The operation has been observed deploying **Raccoon Stealer, RedLine Stealer, Amadey, SmokeLoader, Socelars, Glupteba, XMRig**, and **WebBrowserPassView**, combining credential theft, botnet activity, and cryptomining in a single infection chain. Researchers said the operators used layered evasion and persistence techniques, including disabling Microsoft Defender, anti-VM and anti-debug checks, scheduled tasks, registry `Run` keys, fake VirtualBox-named services, and a masqueraded `csrss.exe` path, while a gaming-themed **“Mobile Arena”** lure targeted young Russian-speaking users. The campaign’s infrastructure included command-and-control systems hosted on **TimeWeb Ltd.**, a broader 44-server cluster, and dead-drop resolvers on **Telegram, Mastodon, and Pastebin**. Additional reporting tied the operation to command-and-control traffic concealed behind **GitHub redirects** and exposed indicators including suspicious installer filenames, hashes, domains, IP addresses, Telegram and social-media handles, anti-virtualization artifacts, and **Monero** mining infrastructure such as `pool.supportxmr.com:3333`. VMRay also identified **STANDOFF COORD**, a Russian-language multi-operator console designed for **Active Directory** intrusion, alongside a separate AI-enabled influence platform used for Telegram account farming and mass messaging.
Jul 28, 2026