Sality: a botnet from 2003 was shut down after 23 years by simply playing along

Sality was first observed in 2003, when Windows XP was two years old. On 31 August 2026 it was shut down. In between lie 23 years, over 11 million unique IP addresses, up to a million machines at its peak, and an operator who has still not been arrested. The operation, coordinated by US authorities with Europol, Eurojust, CrowdStrike, the Shadowserver Foundation and police forces in Bulgaria, Hungary and Romania, seized not a single server. It took the botnet apart through its own protocol.

Europol has coordinated the operation since 2017. The takedown itself ran over the peer protocol of the botnet, not over seizures. (Quelle: Europol / Wikimedia, public domain)

What Sality is

A file infector. Sality attaches itself to executables and spreads through network shares, removable media and filesharing, with no phishing, no exploit kit, and nothing the operator has to do. It never had a central command server. Every infected machine keeps a list of so-called super peers, publicly reachable bots that distribute signed instructions and payloads. According to CrowdStrike, two mutually incompatible networks ran in parallel to the end, version 3 and version 4, same codebase, different keys, same operator.

The main payload of the past eight years was a program called EggJagger. It watches the clipboard for Bitcoin and Ethereum addresses and swaps them for the operator's addresses on paste. CrowdStrike estimates the take at at least 12.1 million roubles, roughly 150,000 US dollars, while the never-spent portfolio reached a value of about 147 million roubles in January 2025. On top of that came three documented DDoS campaigns, one of them on 25 February 2022 against a forum in Kharkiv, a day after the Russian assault on the city. The actor, tracked by CrowdStrike as SALTY SPIDER, is thought to sit in the Russian republic of Bashkortostan, according to BleepingComputer.

The flaw that could not be repaired for 20 years

Every 40 minutes a bot checks whether its stored peers still answer. Whoever answers gains standing in the list, whoever does not loses it and eventually drops out. So far, ordinary peer-to-peer. The design flaw: a bot trusts anyone who speaks the protocol. No authentication, no cryptographic identity for peers, no allowlist. Anyone publicly reachable who answers the handshake correctly is a full super peer, indistinguishable from a real infection.

And that flaw could not be fixed. A file infector cannot update itself without competing with its own older strain for the same host files. A new protocol version would have split the network instead of securing it. CrowdStrike puts it this way: the protocol behaviour of the bots today is the same as it was 20 years ago, and every weakness in it is permanent.

Bots behind NAT are dealt with passively: as soon as they contact a sinkhole, their peer list is emptied. (Quelle: CrowdStrike, Peer Pressure: Inside the Sality Botnet Disruption Operation, 1 September 2026)

The attack uses exactly that maintenance cycle. First the legitimate super peers were devalued at the protocol level during verification, so that they dropped out of the lists. Sinkhole entries from the defenders moved into the emptied lists. The majority of infections sit behind NAT or a firewall and are not directly reachable; those were dealt with passively. As soon as such a bot contacted a sinkhole in its normal cycle, its peer list was emptied and it stayed alone for good. From the operator's point of view, machines simply vanished. In parallel, the authorities took down the URLs hosting the current payloads, so that bots still holding a valid download package could not fetch anything more.

The technique is not new. CrowdStrike used the same class of peer-list manipulation against GameOver Zeus in 2014 and against Kelihos in 2017. Their researcher Tillmann Werner still calls Sality the most complex botnet takeover the company has ever carried out, according to The Record.

How big was it in the end?

Here the sources contradict each other. CrowdStrike writes in its own blog of more than 33,000 infected machines worldwide. The Register, The Record, BleepingComputer and Help Net Security consistently say more than 15,000. No source explains the difference. The plausible reading is that 33,000 counts both network versions cumulatively and 15,000 counts the systems connected at the same time on the cut-off date, but that is not documented. For a sysadmin, both say the same thing: at the time of the takedown, the botnet was small, old and still there.

A file infector does not survive two decades in well-maintained server farms, it survives in the corners nobody looks at any more. (Quelle: Europol, CrowdStrike, Wikipedia)

What to take away

First, the one line that justifies this post: UDP traffic to the address 188.166.101.148, according to CrowdStrike the lighthouse IP of the network, means an active infection. That is a search in the firewall log or a rule in the SIEM, not a statement of probability. CrowdStrike also supplies two YARA rules that look in memory for the hardcoded RSA keys.

Second: the takedown removes nothing. The command channel is dead, the malware on the machines keeps running, and CrowdStrike says so explicitly. Sality touched every executable it could reach. Finding it means rebuilding the host.

Third, the question a botnet from 2003 puts to a network in 2026. What is affected is not well-maintained servers with EDR, it is the things that have been running along for years: the machine on the production line, the old point-of-sale system, the notebook with USB stick traffic, the Windows island without an agent. So the question is not "do I have Sality", it is "which hosts in my network would even have noticed". Shadowserver notifies through ISPs and national CSIRTs, in Austria through CERT.at; any network operator not yet subscribed to the free Shadowserver reports now has a concrete reason to start. And anyone who has been putting off a USB policy for years now has a vivid argument.