![\"Trung](\"https:\/\/vncybers.vn\/wp-content\/uploads\/2026\/09\/sality-inline-1.jpg\")
<\/p>\nSality is one of the longest-running Windows malware families in modern cybersecurity history. After more than two decades of spreading through executable files, USB drives, network shares, email, compromised websites and peer-to-peer networks, the infrastructure has now been disrupted in an international operation involving law enforcement and private-sector security teams.<\/p>\n
On August 31, 2026, the U.S. Department of Justice announced the Sality takedown with participation from authorities in the United States, Bulgaria, Hungary and Romania, alongside CrowdStrike and the Shadowserver Foundation. The focus was not only seizing related domains, but also turning Sality's peer-to-peer mechanism into a weakness that isolated infected machines from new payload delivery.<\/p>\n
<\/p>\n
Sality has been observed in the wild since around 2003, first standing out as a file-infecting malware targeting Windows executables. Over time, it evolved into a botnet capable of self-propagation, maintaining a peer-to-peer network and distributing additional malware to compromised machines.<\/p>\n
The security community tracks the group operating Sality under several names, including Salty Spider, Sality, KuKu, SalLoad, Kookoo and SaliCode. Reports summarized by The Hacker News say the group is believed to operate from the Republic of Bashkortostan in Russia, with financial gain as the primary motive.<\/p>\n
What makes Sality notable is not a single vulnerability, but its resilient operating model. The botnet does not depend entirely on one central command-and-control server. Instead, many variants use a P2P network so infected machines can share peer lists, receive payload download instructions and keep the operation alive even when parts of the infrastructure are blocked.<\/p>\n
Since 2003, Sality has repeatedly appeared in malware distribution campaigns targeting Windows systems. It can modify executable files, persist through internal shares and enable activity such as credential theft, spam distribution, unauthorized proxy services, network exploitation and distributed denial-of-service attacks.<\/p>\n
In later stages, several Sality variants integrated P2P communication. Two independent peer-to-peer networks, commonly known as version 3 and version 4, remained active until the disruption. CrowdStrike said the two networks shared the same codebase but used incompatible protocol versions and different cryptographic keys.<\/p>\n
In 2022, Dragos documented a campaign targeting industrial engineers and operators to seize control of PLC devices and fold them into the Sality ecosystem. That detail shows the botnet was not only a personal-computer problem, but could also touch industrial environments when the infection chain became broad enough.<\/p>\n
By 2026, CrowdStrike estimated that Sality infrastructure could still distribute payloads to more than 15,000 infected machines worldwide. One notable payload was EggJagger, a clipboard-monitoring tool that replaces cryptocurrency wallet addresses with attacker-controlled ones. Public reporting says this method helped the operators steal at least $150,000.<\/p>\n
Rather than only finding and removing command servers, the participants used sinkholing and peer-list manipulation to sever the botnet's communication path. The approach exploited Sality's default trust model: a machine could join the network if it responded correctly to the protocol handshake, while the botnet lacked strong peer identity authentication.<\/p>\n
Sality periodically checks stored peers to determine which machines remain online. By manipulating the peer list, defenders steered infected machines toward infrastructure under defensive control, preventing them from receiving payload instructions from the operators. Similar techniques were used in the 2014 GameOver Zeus and 2017 Kelihos botnet disruptions.<\/p>\n
The special factor is that Sality is difficult to patch from the operator side in this scenario. Because its propagation depends largely on attaching code to executable files on disk, the botnet does not have the same flexible central update channel as many modern malware families. The same property that once made it resilient against traditional takedowns became a weakness when the P2P network was redirected.<\/p>\n
Technically, the operation shows that modern botnet defense must go beyond blocking domains or IP addresses. With P2P networks, the decisive points are protocol design, trust between nodes, peer identity, and the way payloads move across the network.<\/p>\n
Legally, the case reflects the growing importance of coordination between public authorities and the private sector. The U.S. Department of Justice handled domain seizure and legal coordination, while security organizations such as CrowdStrike and Shadowserver contributed analysis, measurement, sinkholing and cleanup support.<\/p>\n
Economically, the direct damage from Sality is not limited to redirected cryptocurrency transactions. The real cost also includes persistently infected workstations, credential risk, abused bandwidth, internal investigation time and the possibility that the botnet could be repurposed for DDoS or further malware distribution.<\/p>\n
Sality survived not only because of technology. It exploited ordinary habits: downloading software from unclear sources, moving files through USB drives, using poorly controlled internal shares, opening email attachments and keeping old Windows machines with limited monitoring.<\/p>\n
In many organizations, overlooked systems such as secondary workstations, machines used in operations environments or legacy devices can become the links that allow malware to persist. When a botnet can self-propagate and reinfect through an internal environment, cleaning only the most visible machines is rarely enough.<\/p>\n
For individuals, the basic lessons remain: avoid software from untrusted sources, keep operating systems updated, enable anti-malware protection, be cautious with executable files and carefully verify cryptocurrency wallet addresses before transactions.<\/p>\n
For organizations, Sality highlights the need for asset management, removable-media controls, monitoring for unusual P2P traffic, network segmentation, review of legacy Windows systems and an incident-response process for signs of widespread infection.<\/p>\n
For the cybersecurity community, the case is a reminder that a long-running botnet does not disappear after a warning article. It requires shared data, cross-border legal coordination and technical tactics that match the malware's own architecture.<\/p>\n
Sality was not disabled because it was simple, but because defenders understood how it worked. When an attack infrastructure is designed to survive through peer-to-peer networking, the most effective response can be to use that same peer-to-peer logic to isolate the operators from infected machines.<\/p>\n
VNCyberS<\/strong> compiled from The Hacker News, BleepingComputer, U.S. Department of Justice, CrowdStrike and the Shadowserver Foundation<\/em><\/p>","protected":false},"excerpt":{"rendered":" Sality l\u00e0 m\u1ed9t trong nh\u1eefng h\u1ecd m\u00e3 \u0111\u1ed9c Windows t\u1ed3n t\u1ea1i dai d\u1eb3ng nh\u1ea5t trong l\u1ecbch s\u1eed an ninh m\u1ea1ng hi\u1ec7n \u0111\u1ea1i. Sau h\u01a1n hai th\u1eadp k\u1ef7 l\u00e2y lan qua t\u1ec7p th\u1ef1c thi, \u1ed5 USB, chia s\u1ebb m\u1ea1ng, email, website b\u1ecb x\u00e2m nh\u1eadp v\u00e0 m\u1ea1ng ngang h\u00e0ng, h\u1ea1 t\u1ea7ng n\u00e0y v\u1eeba b\u1ecb c\u00e1c c\u01a1 quan […]<\/p>\n","protected":false},"author":2,"featured_media":1998,"comment_status":"","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":""},"categories":[70],"tags":[761,766,768,765,770,769,764,762,759,760,767,763],"class_list":["post-1999","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-ho-so","tag-botnet-p2p","tag-crowdstrike","tag-department-of-justice","tag-eggjagger","tag-ho-so-ma-doc","tag-ma-doc-windows","tag-peer-list-manipulation","tag-peer-to-peer-malware","tag-sality","tag-sality-botnet","tag-shadowserver-foundation","tag-sinkhole"],"_links":{"self":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/posts\/1999","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/comments?post=1999"}],"version-history":[{"count":0,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/posts\/1999\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/media\/1998"}],"wp:attachment":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/media?parent=1999"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/categories?post=1999"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/tags?post=1999"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}