Key facts
- US officials and CrowdStrike have dismantled the Sality botnet, a Russian cybercrime operation active since 2003.
- For the past eight years, Sality used a 'clipjacking' tool called EggJagger to steal cryptocurrency by replacing legitimate wallet addresses with those controlled by the operator.
- At least $150,000 in cryptocurrency was stolen through the EggJagger payload.
- The operator's unspent cryptocurrency holdings peaked at approximately $1.35 million.
- The operation involved seizing Sality-linked domains in the US and disrupting its peer-to-peer network infrastructure in Bulgaria, Hungary, and Romania.
- CrowdStrike exploited Sality's peer-to-peer architecture to isolate approximately 15,000 infected machines.
U.S. officials and cybersecurity firm CrowdStrike announced Tuesday the dismantling of Sality, a Russian peer-to-peer botnet that has been active since 2003. For the past eight years, Sality's primary function was to hijack cryptocurrency payments by replacing legitimate wallet addresses with those belonging to the operator. This 'clipjacking' technique, facilitated by a payload called EggJagger, is estimated to have stolen at least $150,000 worth of Bitcoin and Ethereum.
The operation involved a multinational effort, with actions taken in the United States, Bulgaria, Hungary, and Romania. U.S. law enforcement, including the Justice Department and FBI, seized Sality-linked domains, while CrowdStrike disrupted the botnet's network by exploiting its peer-to-peer architecture. Infected machines were tricked into connecting to CrowdStrike-controlled sinkholes, effectively isolating them from the botnet's command and control.
Before focusing on cryptocurrency theft, Sality was used to deliver payloads for credential theft, spam, proxy services, and denial-of-service attacks. Notably, a significant portion of the stolen cryptocurrency was left untouched, accumulating a peak value of approximately $1.35 million in January 2025. CrowdStrike researcher Tillmann Werner described the takeover as the most complex botnet operation they had undertaken, highlighting Sality's resilience due to its lack of a central server.
The operator, tracked as SALTY SPIDER, occasionally used the botnet for personal grievances, such as a denial-of-service attack against a Russian cryptocurrency exchange in September 2023. The Shadowserver Foundation is assisting internet providers in notifying victims.