Full Report
The U.S. Department of Justice (DoJ) on Tuesday announced the takedown of a long-standing peer-to-peer (P2P) botnet known as Sality as part of a coordinated law enforcement operation. The effort was undertaken on August 31, 2026, by authorities from the U.S., Bulgaria, Hungary, and Romania, in collaboration with private industry partners CrowdStrike and the Shadowserver Foundation. To that
Analysis Summary
# Incident Report: International Takedown of the Sality P2P Botnet
## Executive Summary
On August 31, 2026, the U.S. Department of Justice, in coordination with international law enforcement and private partners, successfully dismantled the long-standing Sality peer-to-peer (P2P) botnet. The operation utilized a "sinkholing" technique and peer list manipulation to isolate over 15,000 infected machines from the threat actor’s control. Sality, active since 2003, was primarily used for financial theft, spam, and politically motivated DDoS attacks.
## Incident Details
- **Discovery Date:** Documented in the wild since 2003
- **Incident Date:** Takedown operation executed August 31, 2026
- **Affected Organization:** 15,000+ globally distributed infected hosts (including Industrial Control Systems/PLCs)
- **Sector:** Cross-sector (Financial, Industrial, Government, Private)
- **Geography:** Global (U.S., Bulgaria, Hungary, and Romania listed as key operation participants)
## Timeline of Events
### Initial Access
- **Date/Time:** Ongoing since 2003 (multiple variants)
- **Vector:** Multi-vector (Infected network shares, USB devices, compromised websites, email attachments, and P2P networks)
- **Details:** Sality acts as a self-propagating file infector, attaching its code to legitimate Windows executable files on disk.
### Lateral Movement
- **Propagation:** Once inside a network, the malware spreads via network shares and infected removable media (USBs), effectively automating its own lateral movement without actor intervention.
### Data Exfiltration/Impact
- **Financial Theft:** Deployment of "EggJagger" (clipjacking tool) to steal approximately $150,000 in cryptocurrency by swapping wallet addresses in the clipboard.
- **DDoS Campaigns:** Targeted attacks against forex forums (2016), Ukrainian forums (2022), and AvanChange (2023).
- **Credential Theft:** Ongoing exfiltration of user credentials and sensitive data from compromised machines.
### Detection & Response
- **Discovery:** Long-term tracking by CrowdStrike and Shadowserver; 2022 Dragos report on PLC targeting.
- **Response Actions:** A coordinated P2P sinkhole operation was launched to inject controlled nodes into the botnet, effectively "turning the network against itself."
## Attack Methodology
- **Initial Access:** File infection, USB autorun, and malicious email attachments.
- **Persistence:** File infector capabilities; the malware modifies existing Windows executables to ensure it runs whenever the system or specific apps are used.
- **Defense Evasion:** Use of P2P architecture instead of centralized C2 servers, making traditional domain blacklisting difficult.
- **Credential Access:** Keylogging and monitoring of system activity for sensitive data.
- **Discovery:** Scanning for network shares and connected storage devices.
- **Lateral Movement:** Automated spreading through P2P communication and network share infection.
- **Collection:** Clipboard monitoring via the EggJagger payload.
- **Impact:** DDoS attacks, crypto-currency theft, and proxying of malicious traffic.
## Impact Assessment
- **Financial:** Minimum $150,000 in documented crypto-theft; costs related to global incident response and remediation.
- **Data Breach:** High volume of PII and credentials stolen from 15,000+ hosts over two decades.
- **Operational:** Disruption of industrial operations (targeting of PLCs and engineers).
- **Reputational:** Damage to organizations whose infrastructure was used to launch DDoS attacks or host proxy services.
## Indicators of Compromise
- **Network Indicators:**
- `forex2030[.]com` (DDoS target)
- `kharkovforum[.]com` (DDoS target)
- P2P communication on non-standard ports (v3 and v4 protocols).
- **File Indicators:**
- Presence of "EggJagger" clipper malware.
- Modified Windows executables (PE files) with appended malicious sections.
- **Behavioral Indicators:**
- Unauthorized modification of cryptocurrency addresses during copy-paste operations.
- Unusual P2P traffic originating from Windows workstations or PLCs.
## Response Actions
- **Containment:** Sinkholing of the P2P network to prevent the threat actor from sending new commands.
- **Eradication:** Seizure of Sality-linked domains in the U.S. and Europe.
- **Recovery:** Collaborative effort with Shadowserver to notify affected ISPs and victims for local remediation.
## Lessons Learned
- **Immutable Architecture:** Sality’s greatest strength (its P2P architecture) was its weakness; the inability to patch the protocol allowed law enforcement to permanently poison the peer list.
- **ICS Vulnerability:** The targeting of PLCs highlights that traditional "IT malware" can have significant consequences for Operational Technology (OT) environments.
- **Longevity:** A botnet can remain active for over 20 years if it possesses effective self-propagation and decentralized command structures.
## Recommendations
- **Endpoint Protection:** Use EDR/AV solutions capable of detecting file-infector behavior and unauthorized changes to executables.
- **Network Segmentation:** Isolate OT/PLC environments from general IT networks to prevent self-propagating botnets from crossing over.
- **Security Awareness:** Educate users on the risks of using untrusted USB devices and clicking on unverified email attachments.
- **Monitoring:** Implement monitoring for unauthorized P2P traffic and clipboard modifications.