A multinational operation involving law enforcement agencies and cybersecurity firms has successfully dismantled the Sality botnet, a sophisticated cybercrime operation active since 2003 that evolved to focus on stealing cryptocurrency. The takedown, announced Tuesday, September 1, 2026, targeted the botnet’s infrastructure across the United States, Bulgaria, Hungary, and Romania.
For the last eight years of its operation, Sality primarily engaged in cryptocurrency theft by hijacking user transactions. This was achieved through a tool known as EggJagger, which monitored infected computers’ clipboards for cryptocurrency wallet addresses. When a user copied a Bitcoin or Ethereum address to send funds, EggJagger would swap it with an address controlled by the botnet operator, diverting the cryptocurrency to their own wallets. This clipjacking technique meant that victims unknowingly sent their digital assets to the attackers.
The operation to dismantle Sality was led by CrowdStrike and the U.S. Justice Department, with significant involvement from the FBI and the Defense Criminal Investigative Service. Law enforcement agencies seized Sality-linked domains in the U.S. and Europe. CrowdStrike’s Counter Adversary Operations team played a crucial role by redirecting infected machines to sinkholes controlled by the firm, effectively isolating over 15,000 machines worldwide.
Before its focus on cryptocurrency, the Sality botnet was used for a variety of malicious activities, including credential theft, spam distribution, proxy services, and denial-of-service attacks. The operator, tracked by CrowdStrike as SALTY SPIDER, also occasionally used the botnet for targeted attacks. In September 2023, a denial-of-service payload was directed at AvanChange, a Russian cryptocurrency exchange.
Sality’s longevity and resilience were partly due to its decentralized, peer-to-peer architecture, which lacked a central server that could be easily seized. Infected machines communicated directly with each other, making the botnet difficult to track and disrupt. The malware spread by attaching itself to executable files, regenerating without direct operator intervention.
CrowdStrike estimates that the never-spent cryptocurrency portfolio associated with the botnet reached a peak value of approximately 147 million rubles (nominally $1.35 million USD) in January 2025. However, the exact total amount of cryptocurrency stolen by the Sality botnet remains uncertain, as does the full identity of the operator(s) behind SALTY SPIDER.
While the botnet infrastructure has been disrupted, CrowdStrike warns that malware already present on infected machines will remain active until manually removed. The Shadowserver Foundation is collaborating with internet providers to notify victims of potential infections. The takedown highlights the persistent and evolving nature of cyber threats, particularly in the cryptocurrency space, and underscores the importance of sustained international cooperation in cybersecurity efforts.
Why This Matters
The materials describe a narrow update: A multinational operation led by CrowdStrike and the U. The exact total amount of cryptocurrency stolen by the Sality botnet.
Broader Context
Source materials place the factual news in this context: Sality botnet has circulated since 2003.
Leave a Reply