NewsBite analysis · Business, Security · Security Vulnerability
BleepingComputer
Sality botnet infrastructure dismantled in joint global takedown
A multinational effort led by the U.S. Department of Justice and FBI has resulted in the dismantling of the Sality botnet infrastructure, active for over 20 years. This operation targeted both U.S. and European domains associated with Sality, effectively disrupting its P2P network that had been used for various cybercrimes including credential theft and DDoS attacks. The action is hailed as a significant victory against long-standing cybercrime networks.
Act nowConfidence: HighImmediate horizon
Published 2 Sept 2026, 08:50 UTC2 min read
Visit original article ↗Lead image — BleepingComputer
Summary
TL;DR
- Sality botnet has been active for more than two decades.
- More than 15,000 devices were infected with Sality malware.
- Joint operation conducted by international law enforcement and CrowdStrike.
- Sality primarily used to distribute EggJagger malware in clipjacking attacks.
- The botnet's control channels were effectively dismantled.
Interesting facts
- Sality has evolved over time, distributing various malware types.
- CrowdStrike tracks the Sality operator as SALTY SPIDER based in Russia.
- The botnet's historical operation involved tens of thousands of infections since at least 2003.