Sality P2P Botnet Disruption: Peer-List Sinkholing Ends a 23-Year Operation

On 31 August 2026, CrowdStrike Counter Adversary Operations executed a peer-to-peer sinkhole against Sality, a polymorphic file infector that has run as a decentralized botnet since 2003. Coordinated domain seizures by the U.S. Department of Justice, FBI, DCIS, and law enforcement in Bulgaria, Hungary, and Romania, with support from Europol, Eurojust, and the Shadowserver Foundation, closed the remaining payload-hosting URLs. The operator, tracked by CrowdStrike as SALTY SPIDER, no longer has a command channel into the live network.

That outcome matters because Sality was built to survive the usual playbook. There was no central command-and-control server to seize. Peers exchanged tasking directly. The protocol had not been patched in two decades. Historical telemetry puts more than 11 million unique IP addresses against the infrastructure, with a peak near one million concurrent infections. At disruption time, more than 15,000 machines were still receiving payloads.

What Sality Actually Is

Sality began as a Win32 file infector. It attaches to executables and spreads through network shares, removable media, and file-sharing paths. Once a host is infected, the binary regenerates itself without phishing, exploit kits, or operator labor. New variants cannot cleanly replace old ones: an updated strain would compete for the same files and fragment the botnet. That design locked the P2P protocol in place.

Two incompatible networks were still active at takedown, version 3 and version 4. They share a codebase and, per CrowdStrike, a single operator, but they use different protocol versions and different RSA keys for payload signature verification. Bots trust any publicly reachable host that completes the handshake. There is no peer authentication, no cryptographic identity, and no allowlist.

The network’s backbone is a finite list of super peers: infected machines that are reachable from the internet. Every 40 minutes each bot probes that list. Responsive peers gain reputation. Silent peers lose it and are purged. Hosts behind NAT or a firewall cannot be dialed directly; they depend on those super peers for URL packs (lists of payload-hosting URLs on compromised or operator-run web servers) and file packs (direct payload transfers).

Payloads historically covered credential theft, spam, proxy-for-hire, network exploitation, and DDoS. Documented DDoS tasking includes forex2030[.]com in April 2016, kharkovforum[.]com in February 2022, and the AvanChange cryptocurrency exchange in September 2023. CrowdStrike assessed the AvanChange binary was compiled seconds before upload, consistent with opportunistic rather than industrial DDoS-for-hire use.

EggJagger and the Business Model

For the last eight years the primary payload has been EggJagger, a clipjacker. It watches the clipboard for Bitcoin and Ethereum wallet addresses and silently substitutes an address the operator controls. The victim sees a normal copy-paste payment flow. The funds go elsewhere.

CrowdStrike estimates EggJagger alone moved at least ₽12.1 million (about $150,000 USD) in stolen cryptocurrency. An unspent portfolio tied to the campaign peaked near ₽147 million in January 2025. Those figures exclude other historical payload families. The economics are the point: a self-healing file infector plus an unauthenticated P2P fabric produced a low-overhead cash-out channel that ran for years with almost no day-to-day operator work.

How the Disruption Worked

P2P resilience is real against server seizures. It is weaker against a defender who speaks the protocol. CrowdStrike used the same class of peer-list manipulation applied to GameOver Zeus (2014) and Kelihos (2017), tuned to Sality’s 40-minute verification cycle.

1. Invalidate legitimate super-peer entries during verification so each bot’s view of the backbone collapses.
2. Inject defender-controlled sinkholes into the emptied lists to capture beacons, measure isolation, and support victim notification.
3. Hit super peers first. Once the backbone is gone, URL packs and file packs stop propagating.
4. Let NAT-hidden bots isolate themselves. When they contact a sinkhole on their normal timer, their peer lists are purged and they stay cut off.

In parallel, authorities seized Sality-linked domains in the United States and Europe so bots still holding a last URL pack could not fetch a fresh payload during cutover. From the operator’s side, the fleet disappeared. Isolated bots still run local malware. They no longer receive new tasking.

Shadowserver is working with ISPs and national CSIRTs on infection identification and victim notification. That work continues after the takedown. Sinkholing stops the network. It does not clean endpoints.

MITRE ATT&CK Mapping

What Defenders Should Do Now

Disruption is not remediation. File infection and any already-deployed EggJagger or older payload stay resident until the host is cleaned.

• Hunt UDP traffic to the sinkhole lighthouse 188.166.101[.]148. Any match is an active Sality infection.
• Scan running processes with the CrowdStrike YARA rules that match the string IPFILTERDRIVER plus the embedded RSA public key for version 3 or version 4. Actor metadata in those rules is SALTY SPIDER.
• Block and review historical connections to the last URL packs (v3 pack version 25202 and v4 pack version 31010) listed below.
• Treat infected endpoints as dual-problem hosts: the infector plus whatever secondary malware landed before 31 August 2026. Clipboard-monitoring tools, unexpected proxy listeners, and unexplained outbound HTTP to low-reputation file hosts are high-value follow-on hunts.
• Assume removable media and internal file shares were distribution paths. A single cleaned workstation is not a clean estate if infected binaries remain on a share.

Memory-scan YARA (published by CrowdStrike)

rule CrowdStrike_Salityv3_01 : p2p sality version3
{
    meta:
        copyright = "(c) 2026 CrowdStrike Inc."
        description = "Sality Version 3"
        version = "202608181745"
        last_modified = "2026-08-18"
        actor = "SALTY SPIDER"
        malware_family = "Sality"
    strings:
        $ = "IPFILTERDRIVER"
        $ = {
            99 65 40 34 cd ae 9d b3  af f5 82 ad 8c 2e 63 51
            e1 34 53 fa 47 54 e4 70  97 4c a5 3d 3c a3 9b 57
            29 02 49 89 46 4c f2 76  b1 ad 8e 79 5d b2 41 28
            4f 2a a5 9a 13 18 c0 1d  ed da e4 52 98 16 7f b3
            a9 d7 7a e4 c4 6f 51 f6  38 fe a6 fb ad 8c 64 1d
            23 b5 a4 9d 40 20 74 61  be 81 c3 eb 3d 24 01 75
            13 07 58 c5 f0 56 09 94  58 e7 6b c3 f3 8c 70 73
            4e f5 0b 2d 88 0b 9a bd  18 e4 36 72 26 1a 32 9b
        }
    condition:
        all of them
}

rule CrowdStrike_Salityv4_01 : p2p sality version4
{
    meta:
        copyright = "(c) 2026 CrowdStrike Inc."
        description = "Sality Version 4"
        version = "202608181745"
        last_modified = "2026-08-18"
        actor = "SALTY SPIDER"
        malware_family = "Sality"
    strings:
        $ = "IPFILTERDRIVER"
        $ = {
            bb d2 96 8e ed 0b 93 8a  82 e4 e9 bc c3 c5 32 72
            4c 08 aa 56 9f 2d 64 0f  1b 86 68 0e 2b 62 e9 c6
            35 6d 75 b6 32 2d 4f a8  b8 d9 2a 44 8b f0 7f e0
            d9 8e be 66 9d a6 7a 9a  6d e1 45 f1 d3 48 01 0d
            39 2e 9d 2a 45 fb 0b fb  1d 96 f3 b7 4f 55 e5 e1
            16 5b f7 a1 cc 7c 87 c0  c8 9c ef 4e ce 29 58 e2
            99 bd 8a 7a 55 be b4 1c  d9 79 52 25 d8 28 86 7b
            81 39 98 5f 2c 6f 14 bb  a5 6b ce 44 e5 91 93 38
            8b 9a c1 74 46 84 e1 26  ec 04 94 96 75 09 e3 b5
            88 d6 08 f0 4a b7 84 d3  13 2f 00 cc d5 2a 8c 17
            07 09 de 6f b0 d3 d6 2b  c6 a6 9d 38 18 8c 74 9d
            86 16 d5 48 6e 97 32 db  e1 4e f8 04 a6 00 7c 16
            2e 70 1c 23 37 dd 5a 52  76 62 70 d4 86 66 6e df
            0c e9 a1 68 f9 5e e8 dd  09 0c 02 7d 35 d0 54 e7
            00 c0 14 9f ce 4a 9f f3  99 50 1a 0b cd cc ff 05
            b9 04 12 e2 11 76 2f ff  a4 6e 64 18 e0 d0 7b 3b
        }
    condition:
        all of them
}

Indicators of Compromise

Implications for CISOs and Detection Engineering

Sality is a reminder that "no C2 server" is not the same as "no control plane." The control plane was the peer list. Once that structure was writable by anyone who implemented the handshake, longevity became a liability: the same unauthenticated protocol that survived 23 years could not exclude a defender.

For executives, the residual risk is endpoint and share hygiene, not a rebuilt Sality C2. Infected PCs can still clipjack crypto payments, proxy traffic, or carry older stealers. For detection engineers, the durable lesson is protocol fidelity. Reputation-based P2P meshes that never authenticate peers will keep showing up in older crimeware. The cost of mapping handshake, timer, and list semantics is high. It is also the only reliable path to isolation when there is nothing to sinkhole at DNS.

No public charging document has named an individual operator. Domain seizures and sinkholing are infrastructure actions. They do not retire the person who ran EggJagger. Watch for a successor loader that copies Sality's spread method but adds authenticated peer identity. That is the obvious patch the original protocol could never ship.

Sources

The intelligence provided in this report is derived from the following authoritative threat intelligence analysis:

• CrowdStrike: Peer Pressure: Inside the Sality Botnet Disruption Operation, 1 September 2026

Want intelligence like this delivered continuously? Create your free Threat Landscape account today, or unlock the full platform for only $49/month.