Authorities Turn Sality's P2P Network Against Itself, Cutting Off New Malware Payloads

Authorities from the U.S., Bulgaria, Hungary, and Romania, in collaboration with CrowdStrike and the Shadowserver Foundation, disrupted the long-standing Sality peer-to-peer botnet on August 31, 2026. The operation used peer list manipulation to turn the botnet's P2P architecture against itself, sinkholing traffic and preventing infected machines from receiving new payloads. Sality, active since 2003, infects Windows executables and has delivered payloads like EggJagger, a clipper malware that steals cryptocurrency by replacing wallet addresses. While the disruption halts new payload delivery, existing infections remain active and require remediation.

AI-extracted · verify before operational use