Authorities Turn Sality's P2P Network Against Itself, Cutting Off New Malware Payloads
Summary: The U.S. Department of Justice announced the takedown of the Sality peer-to-peer botnet in a coordinated operation carried out on August 31, 2026, by authorities from the U.S., Bulgaria, Hungary, and Romania with CrowdStrike and the Shadowserver Foundation, using a peer-to-peer sinkhole and domain seizures in the U.S. and Europe. Sality, documented in the wild since 2003 and attributed to a threat actor tracked as Salty Spider and other names and believed to operate from Bashkortostan in Russia, had distributed payloads to more than 15,000 infected machines through two P2P networks, version 3 and version 4, and its EggJagger clipper payload is estimated to have stolen at least $150,000.
What's compelling: CrowdStrike states that existing malware already installed on infected systems remains active and must be removed, and that any UDP traffic to the lighthouse IP 188.166.101[.]148 in your logs indicates an infection requiring remediation.
Read the original at The Hacker News ↗
- Topics
- Cybercrime & Law Enforcement
- Related
- Gootloader Malware Disrupted After Infecting 25,000 Computers Cyber Risks · Nov 13, 2026354 dark web vendors and buyers arrested in Operation Tor Nado Cyber Risks · Nov 13, 2026Law Enforcement Disrupts Gootloader, CastleRAT, and StealC Infrastructure Cyber Risks · Nov 13, 2026