2 SEP 2026 — The FBI, CrowdStrike and European police disrupted Sality on Monday by removing legitimate super peers from infected machines' peer lists and inserting sinkholes, letting the botnet's own 40-minute purge cycle finish the job. The botnet is 23 years old, ran on more than 15,000 machines, and its main payload stole about US$150,000. That is roughly ten dollars a machine.
What was done
The operation involved the US Justice Department, the FBI, the Defense Criminal Investigative Service within the Department of Defense Office of Inspector General, CrowdStrike's Counter Adversary Operations team, the Shadowserver Foundation, and law enforcement in Bulgaria, Hungary and Romania.
US authorities seized Sality-linked domains domestically while European agencies took domains hosted in the three named countries. Shadowserver is coordinating with internet service providers and national CSIRTs on victim identification and remediation.
Sality has been active since 2003. Its primary payload for the past eight years, EggJagger, watches the clipboard for cryptocurrency addresses and substitutes the attacker's own. CrowdStrike estimates at least US$150,000 taken with EggJagger alone.
Poisoning a peer list is the only option available
A conventional takedown, which seizes a central command-and-control server, would not work on Sality. It is a peer-to-peer network where each infected machine keeps a list of other infected machines and instructions propagate between them.
There is nothing to seize in that design, which is why it survived 23 years. What it does have is a maintenance routine: every 40 minutes, a bot drops peers that failed to respond.
The operation turned that routine into the weapon. By removing the responsive super peers from a machine's list and inserting sinkholes that answer but relay nothing, the operation made that housekeeping cycle strip out every remaining route back to the network, leaving each bot to disconnect itself on its own schedule.
The economics were terrible and it survived anyway
Fifteen thousand machines and US$150,000 over eight years works out at about ten dollars per infected machine across the whole period. By the standards of modern criminal operations that is negligible; a single ransomware incident routinely produces more.
Sality persisted precisely because it was not worth anyone's attention, which inverts the usual assumption that low-value malware gets squeezed out. It did not encrypt files, did not lock screens, and did not announce itself. Clipboard substitution fails silently and looks like a user error when it works.
A threat that generates no incidents also generates no incident response, so nobody was ever assigned to remove something that a noisier payload would have got cleaned up within days.
Clipboard substitution is the attack you cannot review
EggJagger's method is worth understanding because it defeats the one verification step everyone is told to perform.
Cryptocurrency transfers are irreversible, so every guide says to verify the destination address before sending. Users do verify — by copying the address from the recipient and pasting it into the wallet, then comparing what appears on screen. When the address is substituted on the clipboard, the string being checked is already the attacker's. It will match itself perfectly every time.
The defences that survive this are the ones that do not rely on reading a long string. Verifying the first and last characters against a source outside the compromised machine, sending a small test amount first, and using a hardware wallet that displays the destination on its own screen all work, because they compare against something the malware cannot rewrite.
Disruption is not removal
Those 15,000 machines are still infected. The operation cut them off from the network; it did not clean them, and no takedown of this kind does.
Sality is a file infector, which matters here more than it usually would. Rather than living in one executable, it appends itself to other executables on the host and on any removable media attached to it. A machine can therefore be reinfected from its own USB stick, and a cleaned machine can be reinfected by a colleague's.
Anyone contacted by an ISP or a CSIRT should know that removing the identified sample is only the start of the work. Every executable on the host and on every drive that touched it has to be treated as suspect, and for a system of this age reimaging is usually cheaper than cleaning.
Why 15,000 machines still exist in 2026
An infection that has run since 2003 lives on machines nobody is looking at. The population is industrial control workstations, laboratory instruments, point-of-sale terminals and building management systems, running versions of Windows that no longer receive updates because the attached equipment requires them.
That population is concentrated in markets where equipment is kept in service longer, and much of Southeast Asian manufacturing and healthcare fits the description. A CNC controller or an imaging workstation is a capital asset with a twenty-year life, and the computer bolted to it is not replaced on an IT refresh cycle.
We reported on ransomware operators targeting ASEAN hospitals, where the same unpatchable equipment was the entry point. Sality is the quieter version of that same exposure, running on machines that were never secured and never made enough noise for anyone to look.
View author profile → · Editorial policy
