U.S. law enforcement agencies, European agencies, and private security firms have been active for over 20 years Sality Malware and botnet infrastructure were shut down through international cooperation. First observed in 2003, Sality is considered one of the longest-running botnets on the Internet.
According to CrowdStrike, the operator used Sality to target victims worldwide More than 15,000 unitsThey were able to distribute additional malware to the infected devices. This operation was carried out by cutting off communication between the infected devices and their operators and seizing the associated domains.
However, "blocked" doesn't mean that the malware has been removed from all infected devices. Since the key was to disable the command-and-control communications, we still need to monitor attempts to repair and restart individual devices.
| A long-running botnet that has been active since 2003
Sality first appeared as malware that infected executable files, and later evolved into a P2P botnet in which infected devices communicate directly with one another. Since we didn't rely on a single central server, the entire network didn't easily collapse even if part of the infrastructure was blocked.
CrowdStrike explained that two P2P networks—which shared the same code base but were incompatible with each other—remained active right up until the operation began. This means that the old malware wasn’t simply left behind; it continued to be used as an operational criminal infrastructure.
| Malware Distributed to More Than 15,000 Devices
The network that was recently blocked was used as a conduit to deliver additional malware to more than 15,000 infected devices worldwide. Rather than performing a wide range of criminal functions on its own, Sality served as a platform for distributing other malicious programs.
In the past, it was linked to credential theft, spam, proxy services, network attacks, and distributed denial-of-service (DDoS) attacks. In recent years, malware designed to spoof cryptocurrency wallet addresses has been observed as a primary payload.
| The P2P structure enables long-term survival
With a typical botnet, blocking the central command server makes it difficult for the operator to control the infected devices. Sality reduced the number of single points of failure by using a peer-to-peer (P2P) structure in which infected devices exchange information with one another.
The fact that the infection spreads through executable files, network shares, and removable storage devices also contributed to its long-term survival. The structure was such that old infections could spread again without the attacker having to launch a new campaign each time.
| International law enforcement agencies and private companies are working together
The operation involved the U.S. Department of Justice, the FBI, investigative agencies under the Department of Defense Inspector General’s Office, CrowdStrike, and the Shadowserver Foundation. Europol, Eurojust, and investigative agencies from Bulgaria, Hungary, and Romania also provided support.
Since botnets utilize devices, domains, and networks across multiple countries, it is difficult for a single organization to disrupt the entire communication infrastructure all at once. The key to this joint effort is coordinating legal domain seizures, technical network blocking, and tracking the status of infections all at the same time.
| Block the connection between the operator and the infected device
The U.S. government seized the domains used in the operation, and CrowdStrike disrupted communications on the P2P network so that infected devices would connect to the defenders' infrastructure instead of following the operator's commands. As a result, it became difficult for the operator to deliver new tasks or malware.
Although the technical details were disclosed only to a limited extent for security reasons, it was explained that the attack exploited structural weaknesses in an outdated P2P protocol. This is an example that demonstrates how even botnets without a central server can be blocked by analyzing the communication trust structure of the entire network.
| “Neutralization” and “complete elimination” are different
Although this operation severed the operator’s control channel, the malicious files on the infected computers did not automatically disappear. If unmanaged legacy systems or already infected storage devices remain, the security risk may persist.
The operator's identity has not been disclosed, and we'll have to wait and see if the service can be resumed using other infrastructure. Companies and individuals need to keep their operating systems and security software up to date and check for suspicious communications and old infected files.
| Even old malware remains a current threat
The Sality block demonstrates that simply blocking the latest vulnerabilities isn't enough. If unpatched devices and outdated operating systems remain connected to the internet, even malware that originated 20 years ago can continue to be used for criminal purposes.
Going forward, it will be important to see how much the number of infected devices actually decreases, whether operators attempt to regain control, and what remediation guidance national agencies provide to the owners of affected devices. Long-term success is more likely to depend on the cleanup efforts and measures to prevent reinfection after the containment operation than on the operation itself.
Tags
#Sality #Botnet #Malware #Cybersecurity #CrowdStrike #U.S. Department of Justice #FBI #Europol #Eurojust #International Cooperation #P2P Botnet #Security Incident #NotRansomware #IT News
