The Sality botnet, active since 2003, has been dismantled by U.S. authorities and CrowdStrike after eight years of cryptocurrency theft.
Major Disruption of Sality Botnet Announced
The U.S. Justice Department and cybersecurity firm CrowdStrike have successfully dismantled the Sality botnet, which has been operating since 2003. This botnet has been notorious for hijacking cryptocurrency transactions for the past eight years, utilizing a tool known as EggJagger to manipulate wallet addresses copied to victims’ clipboards.
How EggJagger Operated
EggJagger functions as a clipjacking tool that monitors clipboard activity. When a user copies a cryptocurrency address, EggJagger replaces it with the operator's address, redirecting funds intended for legitimate transactions to the attacker. CrowdStrike estimates that this operation has resulted in losses of at least $150,000.
Unspent Cryptocurrency Holdings
Interestingly, much of the stolen cryptocurrency remained unspent, reaching a value of approximately 147 million rubles, or $1.35 million, at its peak in January 2025. This strategy of not cashing out has allowed the operator to maintain a significant but hidden portfolio of stolen assets.
Decentralized Structure Aided Longevity
Sality's decentralized architecture contributed to its resilience, allowing infected devices to communicate directly with one another without a central server. This flexibility enabled the botnet to regenerate and spread through network shares and removable drives. CrowdStrike's Counter Adversary Operations team was able to exploit this structure, isolating over 15,000 infected machines worldwide by inserting their own sinkholes into the botnet's communication.
International Law Enforcement Actions
In a coordinated effort, law enforcement agencies in the U.S., Bulgaria, Hungary, and Romania executed actions to dismantle various components of Sality. The Justice Department and the FBI seized domains associated with the botnet, while the Shadowserver Foundation worked with ISPs to inform affected users.
Future Implications
As a result of this disruption, infected devices now report to CrowdStrike-controlled sinkholes, although existing malware on these devices will need to be manually removed to fully eradicate the threat. The operator, known as SALTY SPIDER, has previously directed attacks against cryptocurrency exchanges, demonstrating a potentially reckless approach to cashing out stolen assets.
