Sality Botnet Dismantled After Eight Years of Cryptocurrency Theft

CrowdStrike and the Justice Department have dismantled the Sality botnet, operational since 2003, which spent the last eight years hijacking cryptocurrency payments by rewriting wallet addresses on infected computers. Sality primarily delivered the EggJagger tool, which monitors clipboard activity for cryptocurrency wallet addresses and swaps them for the operator's own, leading victims to send funds to strangers. CrowdStrike estimates that EggJagger alone generated a minimum of 12.1 million rubles, approximately 150000 dollars. The botnet also engaged in credential theft, spam, proxy services, and denial-of-service attacks. The stolen cryptocurrency largely remained untouched, with CrowdStrike valuing the portfolio at a peak of about 147 million rubles in January 2025, equivalent to 1350000 dollars or roughly 4000000 dollars in purchasing power. Sality's decentralized architecture allowed it to evade capture, as infected machines communicated directly with each other. CrowdStrike's team isolated over 15000 machines worldwide by replacing legitimate peers with sinkholes. The Justice Department, FBI, and other law enforcement agencies seized Sality-linked domains in the U.S. and Europe. The operator, tracked as SALTY SPIDER, occasionally targeted entities like the Russian cryptocurrency exchange AvanChange. Infected machines now report to CrowdStrike-controlled sinkholes, and the company has issued warnings about existing malware on these devices.

This content is provided for general informational purposes only and doesn't constitute financial, investment, legal, or tax advice. Any events, rewards, online promotions, or related information mentioned herein should not be considered a recommendation, solicitation, or invitation to purchase, sell, trade, or otherwise deal in any crypto assets. Crypto assets are highly volatile and may result in loss. The availability of WEEX services, products, and related events may vary by region. You are responsible for ensuring that your participation is in accordance with applicable local laws and regulations.