Full Report
23-year-old botnet down
Analysis Summary
# Incident Report: Operation Distant Horizon (Sality Botnet Disruption)
## Executive Summary
In September 2026, an international coalition of law enforcement and private security firms successfully disrupted Sality, a peer-to-peer (P2P) botnet that had been active for over 23 years. The operation utilized a "peer list poisoning" technique to isolate infected nodes into sinkholes, severing the operator's control over 15,000+ compromised machines. The botnet was primarily used for cryptocurrency theft via clipboard hijacking and large-scale malware distribution.
## Incident Details
- **Discovery Date:** Active since 2003; Takedown operation concluded August 31, 2026
- **Incident Date:** Ongoing operations for 23 years
- **Affected Organization:** 15,000+ global machines (Various)
- **Sector:** Cross-sector (General Consumer and Enterprise)
- **Geography:** Global (Law enforcement actions focused in US, Bulgaria, Hungary, and Romania)
## Timeline of Events
### Initial Access
- **Date/Time:** Circa 2003 (Initial launch)
- **Vector:** Multi-vector (Email spam, network exploitation, and malicious downloads)
- **Details:** Sality functioned as a "malware-as-a-service" platform, distributing various payloads over two decades.
### Lateral Movement
- **Details:** The botnet utilized P2P network awareness, where infected "super peers" acted as the backbone to propagate commands and updates without a centralized Command & Control (C2) server.
### Data Exfiltration/Impact
- **Details:** Primarily focused on cryptocurrency theft. The "EggJagger" payload monitored system clipboards for wallet addresses and swapped them with attacker-controlled addresses.
### Detection & Response
- **Discovery:** Long-term monitoring by CrowdStrike Counter Adversary Operations and Shadowserver Foundation.
- **Response Actions:** On August 31, 2026, operatives executed a peer-to-peer sinkhole operation to poison the botnet's peer lists and seized associated domains.
## Attack Methodology
- **Initial Access:** Network exploitation and social engineering.
- **Persistence:** P2P architecture; bots check for updates every 40 minutes.
- **Defense Evasion:** Use of a decentralized P2P structure to avoid a single point of failure (C2 shutdown).
- **Credential Access:** Credential theft modules distributed via the botnet.
- **Discovery:** Peer list maintenance (super peers checking status of neighboring nodes).
- **Lateral Movement:** Propagation through local networks and P2P communication.
- **Collection:** Clipboard monitoring (EggJagger).
- **Exfiltration:** Redirection of cryptocurrency funds; spam distribution.
- **Impact:** Financial theft; DDoS attacks; proxy services for other criminals.
## Impact Assessment
- **Financial:** Estimated $150,000+ in cryptocurrency stolen via EggJagger; additional unknown revenue from proxy and spam services.
- **Data Breach:** Widespread credential theft and system compromise across 15,000+ endpoints.
- **Operational:** System instability for victims; use of victim bandwidth for DDoS and spam.
- **Reputational:** Long-term persistence undermined trust in legacy system security.
## Indicators of Compromise
- **Network Indicators:**
- Traffic to P2P nodes on non-standard ports.
- Connections to seized domains (e.g., [sality-related-domain].com - *defanged*).
- **Behavioral Indicators:**
- Clipboard content changing unexpectedly when copying wallet strings (1[a-zA-Z0-9]{24,34} - *BTC address pattern*).
- Periodic outbound polling every 40 minutes to unknown IPs.
## Response Actions
- **Containment:** Sinkhole operation targeted the "super peer" lists, purging legitimate peers and replacing them with controlled sinkhole entries.
- **Eradication:** US DoJ, FBI, and European authorities seized domains in the US, Bulgaria, Hungary, and Romania.
- **Recovery:** Shadowserver Foundation partnered with ISPs and CSIRTs to notify victims and provide remediation instructions.
## Lessons Learned
- **Key Takeaways:** P2P botnets require specialized "poisoning" techniques rather than standard DNS takedowns due to their decentralized nature.
- **Longevity:** A botnet can survive for decades if it effectively evolves its payload (from simple viruses to crypto-jackers).
- **Collaboration:** Public-private partnerships are essential for dismantling infrastructure spanning multiple international jurisdictions.
## Recommendations
- **Prevention:** Implement endpoint protection that monitors for unauthorized clipboard modifications.
- **Monitoring:** Use network traffic analysis to detect unusual P2P patterns or persistent 40-minute heartbeat intervals.
- **Hygiene:** Ensure systems are patched against the "network exploitation" vectors Sality used for initial entry.