The U.S. Department of Justice, FBI, and Defense Criminal Investigative Service announced a multinational operation to disrupt the Sality botnet on September 1, 2026. According to reports from FBI Cyber Division, the operation isolated more than 15,000 infected machines that had been used to distribute malicious payloads. The botnet, which has been active since 2003, evolved into a peer-to-peer network where infected machines communicated directly with one another rather than relying on central command-and-control servers. First Assistant United States Attorney Bill Essayli framed the effort as demonstrating that "the public and private sectors can be a powerful force for good" against botnets, calling them "a clear and present danger to our nation's security and economy."
EggJagger became Sality's primary payload over the past eight years, serving as a clipjacking tool that monitored victims' clipboards for cryptocurrency wallet addresses and silently replaced them with addresses controlled by the operator. As reported by CrowdStrike, EggJagger alone was responsible for at least 12.1 million rubles, equivalent to approximately $150,000 in stolen cryptocurrency. The stolen cryptocurrency portfolio reached a peak value of about 147 million rubles in January 2025, nominally around $1.35 million. The operation marked one of the most significant actions against a long-running peer-to-peer botnet in recent years, with more than 15,000 systems reportedly still infected at the time of takedown.
According to CrowdStrike's Counter Adversary Operations team, the operation manipulated Sality's peer-to-peer design by removing legitimate peers and inserting CrowdStrike-controlled sinkholes. This isolated infected machines from the operator's control and prevented the botnet from receiving new tasking. The disruption unfolded when CrowdStrike executed a peer-to-peer sinkhole, effectively rerouting botnet traffic away from criminal control. Simultaneously, the DOJ, FBI, and DCIS seized Sality-linked domains inside the United States, while law enforcement agencies in Bulgaria, Hungary, and Romania moved against related domains hosted across Europe. The malware spreads by attaching itself to executable files shared through network shares, removable drives, and file sharing, making it difficult to contain once it enters a network.
The operation involved law-enforcement partners in Bulgaria, Hungary, and Romania supporting related actions in Europe, as reported by FBI Cyber Division. The case drew support from Bulgaria's General Directorate Combating Organized Crime, Hungary's National Bureau of Investigation Cybercrime Department, Romania's Central Cybercrime Unit, Eurojust, and Europol, alongside the DOJ's Office of International Affairs. FBI Los Angeles Assistant Director in Charge Patrick Grandy added that the collaboration strengthens the Bureau's capacity to neutralize threats like Sality, while DCIS Special Agent in Charge Kenneth DeChellis emphasized the operation's importance to protecting the Department of Defense Information Network. The Shadowserver Foundation is working with internet providers to notify victims of the disruption and support victim notification and remediation.
