FBI and CrowdStrike Disrupt Sality Botnet

Key Takeaways

• The Sality botnet, a sophisticated peer-to-peer malware network active since 2003, has been successfully disrupted through an international law enforcement and private sector collaboration.
• The takedown involved the FBI, Department of Justice, and Department of Defense, working with cybersecurity firms CrowdStrike and the Shadowserver Foundation across the U.S., Bulgaria, Hungary, and Romania.
• Sality was responsible for over two decades of cryptocurrency theft and various cyberattacks, leveraging a decentralized architecture that made it notoriously resilient to previous disruption efforts.
• The operation utilized P2P sinkholing by CrowdStrike and coordinated domain seizures to sever criminal control over the botnet, which still comprised over 15,000 active infected systems globally.

Decades-Old Sality Botnet Dismantled in International Cyber Operation

A coordinated international effort, spearheaded by the U.S. Department of Justice (DOJ), has successfully dismantled the Sality botnet, a resilient peer-to-peer (P2P) malware network that has facilitated cryptocurrency theft and cyberattacks globally for over two decades. This significant disruption involved collaboration across the United States, Bulgaria, Hungary, and Romania, uniting federal law enforcement with leading private-sector cybersecurity organizations.

A United Front Against Persistent Cybercrime

The success of this operation, as confirmed by the U.S. Department of Justice announcement, underscores the critical partnership between government agencies and the private sector. Key participants included the DOJ, the Federal Bureau of Investigation (FBI), the Department of Defense’s Defense Criminal Investigative Service (DCIS), alongside cybersecurity specialists CrowdStrike and the Shadowserver Foundation.

Officials characterized this initiative as a practical demonstration of the Trump administration’s “Cyber Strategy for America,” specifically its first pillar focused on “shaping adversary behavior.” This strategy advocates for agencies to work hand-in-hand with private companies to degrade criminal infrastructure and tools, moving beyond traditional enforcement alone.

First Assistant United States Attorney Bill Essayli highlighted the potency of public-private collaboration against botnets and malware, labeling them a “clear and present danger to our nation’s security and economy.” Similarly, FBI Los Angeles Assistant Director in Charge Patrick Grandy emphasized how such partnerships enhance the Bureau’s capacity to neutralize threats like Sality. DCIS Special Agent in Charge Kenneth DeChellis further stressed the operation’s vital role in safeguarding the Department of Defense Information Network.

Understanding Sality’s Resilience

Unlike many botnets that rely on centralized command-and-control servers, Sality operated as a decentralized P2P network. This architecture allowed infected machines, referred to as “bots,” to communicate directly with one another and relay commands without a single point of failure. This design significantly boosted the malware’s resilience, enabling it to evade takedown attempts for years. A notable characteristic of Sality was that most owners of compromised devices remained unaware their systems had been hijacked and integrated into the botnet’s operations.

The Disruption in Detail

The takedown commenced with CrowdStrike’s Counter Adversary Operations team executing a P2P sinkhole. This technical maneuver effectively diverted botnet traffic away from its criminal controllers. Concurrently, the DOJ, FBI, and DCIS seized Sality-linked domains within the United States. Mirroring these actions, law enforcement agencies in Bulgaria, Hungary, and Romania moved against associated domains hosted across Europe.

The Shadowserver Foundation is now actively collaborating with internet service providers and national Computer Security Incident Response Teams (CSIRTs) to identify remaining infections. Their efforts are crucial in supporting victim notification and facilitating remediation processes for affected systems.

This extensive operation received support from various international bodies, including Bulgaria’s General Directorate Combating Organized Crime, Hungary’s National Bureau of Investigation Cybercrime Department, Romania’s Central Cybercrime Unit, Eurojust, and Europol, alongside the DOJ’s Office of International Affairs. Assistant United States Attorney Lauren Restrepo of the National Security Division led the prosecution efforts, supported by the FBI’s Los Angeles Field Office and DCIS.

With an estimated 15,000 systems still infected at the time of the takedown, this operation represents one of the most significant actions against a long-running P2P botnet in recent years. It also signals a growing commitment by federal agencies to leverage private-sector threat intelligence for dismantling persistent cybercrime infrastructure.

What You Should Do

• Run Antivirus/Anti-Malware Scans: Immediately perform comprehensive scans of all systems using reputable antivirus and anti-malware software to detect and remove any potential Sality infections.
• Update Software and Operating Systems: Ensure all operating systems, applications, and security software are fully updated with the latest patches to close known vulnerabilities.
• Implement Network Segmentation: Isolate critical systems and sensitive data within your network to limit the potential spread of malware if an infection occurs.
• Educate Users: Train employees and users on identifying phishing attempts and suspicious links, as these are common vectors for malware delivery.
• Monitor Network Traffic: Implement robust network monitoring to detect unusual outgoing connections or peer-to-peer traffic that could indicate a botnet infection.
• Consult Shadowserver Foundation: If you suspect your organization might have been affected, consult resources from the Shadowserver Foundation, which is actively working on victim notification and remediation.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.