The 2003-vintage botnet spent its final eight years swapping copied bitcoin and ether addresses for the operator's own, and took about $150,000 doing it. There was never a command server to seize.
CrowdStrike's Counter Adversary Operations team severed the Sality botnet from its operator on 31 August, ending a criminal enterprise that had run continuously since 2003. More than 15,000 infected machines were cut off. For the last eight years almost all of them had been doing one job: watching the clipboard for a bitcoin or ethereum address.
The payload responsible, which CrowdStrike calls EggJagger, is about as crude as an attack gets, and that is precisely why it kept working. Wallet addresses are long strings of characters nobody types by hand, so people copy and paste them. EggJagger sat on the infected machine, watched the clipboard, and when something resembling a bitcoin or ether address appeared it substituted an address belonging to the operator. The victim pasted, glanced at nothing, and sent the money to a stranger. Nothing warned them. Nothing could be undone.
Eight years of that brought in at least 12.1 million rubles, about $150,000, on CrowdStrike's estimate. Most of it was never moved. The unspent holdings peaked at roughly 147 million rubles in January 2025 as crypto prices rose, nominally around $1.35 million, though CrowdStrike puts the real purchasing power nearer $4 million in a Western capital. Spread over eight years that is an unremarkable salary. It is also close to pure profit, because Sality cost its operator almost nothing to run.
Sality survived for two reasons, and neither is sophistication. It was a polymorphic file infector before it was a botnet, attaching itself to executables and travelling on network shares and removable drives. No phishing campaign, no exploit kit. Infections regenerated without the operator lifting a finger. Two separate peer-to-peer networks, versions 3 and 4, ran on the same codebase under the same actor with incompatible protocols and different cryptographic keys, and both were live until this week.
There was also no server to seize. Infected machines spoke directly to one another, and every 40 minutes each bot checked whether the peers it knew about were still answering. Peers that replied gained reputation; peers that went quiet were eventually purged. Law enforcement can raid a data centre. It cannot raid a protocol.
What it can do is join. Sality bots never verified who was on the network. Any publicly reachable machine that answered the handshake correctly was accepted as a legitimate peer, with no authentication, no cryptographic identity and no allowlist. Availability was the only requirement. An active defender who speaks the protocol is indistinguishable from an infected PC.
CrowdStrike used that to invert the network's own maintenance cycle. Its team invalidated legitimate super peer entries during peer verification, progressively emptying each bot's address list, then inserted its own sinkholes into the gap. Super peers went first, because they carry the traffic. Machines sitting behind firewalls or network address translation were handled passively: when they called a sinkhole during a routine check, their peer lists were purged and they stayed isolated. It is the same class of technique used against GameOver Zeus in 2014 and Kelihos in 2017.
The operator cannot answer this. A conventional botnet would push a protocol update from its command server; Sality has no command server, and its spreading mechanism makes an update self-defeating. A new variant would have to compete with the existing strain for the same host files, splitting the botnet rather than upgrading it. The behaviour those 15,000 machines exhibit today is the behaviour they exhibited twenty years ago, and every weakness in it is permanent.
The operation ran alongside the US Department of Justice, the FBI, the Defense Criminal Investigative Service and the Shadowserver Foundation, with Europol, Eurojust and police forces in Bulgaria, Hungary and Romania. Those agencies seized the web addresses hosting Sality's payloads, so bots still carrying download instructions had nothing left to fetch. The Justice Department said the operation was based in Russia.
Sality's operator occasionally pointed the network at his own grievances. In February 2022, one day after Russia's full-scale invasion of Ukraine, Sality distributed a payload aimed at kharkovforum.com, a Ukrainian web forum hosting a live thread on the assault on Kharkiv. In September 2023 it hit AvanChange, a Russian cryptocurrency exchange, with a payload compiled seconds before it was uploaded. CrowdStrike reads that second one as an impulsive reaction to a personal dispute. Twenty years of resilient infrastructure, aimed at a customer service complaint.
For anyone holding coins, the practical defence is unglamorous. Check the first and last characters of an address after you paste it, every time. Hardware wallets narrow the problem without solving it, because the address is chosen on the computer before the device ever sees it, and Ledger spent August fixing an Ethereum app that could display one transaction while signing another. Attacks on ordinary crypto users rarely require cleverness. Trezor customers found that out when a Metabase bug at the company's shipping partner exposed 13,689 buyers.
Crypto has been the default monetisation for commodity malware for the better part of a decade; IBM was already documenting the pivot from ransomware to cryptojacking in 2018. Sality's operator picked the version that required no compute and no negotiation with the victim. The disruption stops new payloads reaching infected machines, but it does not clean them: everything already installed is still running. Any computer sending UDP traffic to 188.166.101.148 is still infected.
