The Sality Botnet Neutralized by Its Own P2P Protocol

The US Department of Justice has announced the takedown of the long-running peer-to-peer Sality botnet. Carried out on August 31, 2026, the operation brought together authorities from the United States, Bulgaria, Hungary and Romania, along with private partners — CrowdStrike and the Shadowserver Foundation. Alongside the hijacking of the P2P network, domains linked to Sality were seized in the US and Europe.

Sality has been known since 2003: the malware infects and modifies Windows executables, then distributes additional software to steal credentials, send spam, run proxy services and carry out DDoS attacks. Over time, some versions gained the ability to communicate over a peer-to-peer network, which allowed them to sidestep the traditional tactic of shutting down command servers.

One of the main payloads was EggJagger — a so-called clipper that monitors the clipboard: it swapped out cryptocurrency wallet addresses for ones controlled by the attackers. This method is estimated to have stolen at least $150,000. Beyond financial gain, the botnet was used three times for DDoS attacks, including one against a Ukrainian forum the day after Russia's full-scale invasion began in February 2022.

A weapon turned against its master

The paradox is that it was Sality's very resilience that made its downfall possible. The peer-to-peer protocol cannot be patched: the propagation mechanism is a file infector, not commands from a server. At the same time, the bots blindly trusted the network without any authentication whatsoever: any node that responded to the P2P handshake was accepted as legitimate.

Investigators applied a peer-list manipulation technique — the same approach used in the takedowns of GameOver Zeus in 2014 and Kelihos in 2017. Every 40 minutes the botnet checks whether the “supernodes” it knows about are still alive — publicly reachable infected machines that serve as the network's backbone. Nodes that fail to respond to the check lose reputation and are eventually purged. It was this maintenance cycle that was turned against the botnet: legitimate nodes were removed, and specially prepared sinkhole traps were slotted into their place.

According to CrowdStrike, the botnet was capable of delivering payloads to more than 15,000 infected machines around the world. Up until the takedown, two independent P2P networks remained active — versions 3 and 4, running on a shared codebase but with incompatible protocols and different keys.

In addition to the sinkholing, the operation disabled the URLs from which Sality payloads were downloaded. All infected machines now reach out to CrowdStrike's servers; organizations are advised to look through their logs for UDP traffic to the “beacon” address 188.166.101.148 — any match indicates an infection.

One point is stressed separately: the operation only cuts off the delivery of new payloads, while the malware already installed on machines remains active and must be removed manually. The takedown was described as part of the US cyber strategy “Shaping Adversary Behavior.”

Source: The Hacker News