For eight years, the main job of one of the internet's most stubborn botnets was to watch your clipboard. Sality's payload of choice, a clipjacking tool CrowdStrike calls EggJagger, waited for someone to copy a Bitcoin or Ethereum address, then swapped in one belonging to the operator. On August 31, 2026, the network stopped taking orders.
It had been running since 2003.
CrowdStrike's Counter Adversary Operations team says it executed a coordinated disruption of the botnet with the US Department of Justice, the FBI, the Defense Criminal Investigative Service and the Shadowserver Foundation, supported by Europol, Eurojust and police in Bulgaria, Hungary and Romania. More than 15,000 infected machines had been receiving payloads through it. They now beacon to CrowdStrike-operated sinkholes instead.
Not clever, just impossible to switch off
Sality lasted on architecture rather than sophistication. It ran as two independent peer-to-peer networks, versions 3 and 4, sharing a codebase and an operator but using incompatible protocols and different keys. There were no command and control servers to seize: infected machines talked to each other and routed tasking among themselves. As a polymorphic file infector it also rides executables onto network shares, removable drives and file sharing, so infections regenerated by themselves.
The takings were modest. CrowdStrike estimates the operator stole at least 12.1 million rubles, around 150,000 US dollars, through the clipboard technique, and puts the never-spent portfolio's peak at roughly 147 million rubles in January 2025. Earlier payloads spanned credential theft, spam, proxy services and denial-of-service attacks, and three of those had nothing to do with money. The starkest came on February 25, 2022, a day after Russia's invasion of Ukraine, when Sality pushed a payload at kharkovforum[.]com, a forum hosting a live thread on the offensive against Kharkiv. CrowdStrike assesses that likely aligned with patriotic motivations.
The protocol nobody could patch
What made Sality durable is what finished it. Because it spreads by infecting files rather than pulling updates from a server, the operator could never ship a fixed version: a new strain would compete with the old for the same host files and fragment the botnet. The protocol its bots speak today is the one they spoke twenty years ago, so every weakness in it is permanent. And it trusts anyone. Any publicly reachable machine that answered the handshake correctly was accepted as a peer. No authentication, no cryptographic identity, no allowlist.
Rewriting every bot's address book
Each Sality bot keeps a finite list of super peers, the publicly reachable machines that form the network's backbone, and checks every 40 minutes whether they are still online. Peers that answer accumulate reputation; the rest are purged. CrowdStrike used that cycle against the network, invalidating legitimate super peer entries during verification and injecting purpose-built sinkholes into the emptied lists, the technique class used on GameOver Zeus in 2014 and Kelihos in 2017. Machines behind firewalls or NAT are handled passively: when one calls a sinkhole, its peer list is purged and it is isolated for good. From the operator's side, the bots simply disappear. Law enforcement took down the servers hosting the current payload URLs.
Isolated is not cleaned
The disruption stops new payloads arriving. It does not remove malware already installed, which CrowdStrike says still needs remediating. Any UDP traffic to the lighthouse address 188[.]166[.]101[.]148 confirms an active infection, as do attempts to reach the last payload URLs, among them hxxp://theunforgiven[.]p8[.]hu/img/top[.]gif. Two YARA rules matching the botnet's hardcoded RSA public keys are published in the original report for memory scanning.
Peer-to-peer has long been treated as the architecture you cannot take down, which is part of why Sality survived long enough to become a curiosity. The design that removes the single point of failure also removes the ability to fix anything, or to keep a stranger out. Botnets taking orders from a public blockchain inherit the same bargain, and the clipboard hijacking that funded this one needed no infrastructure at all.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.