Global Takedown of Sality Botnet Isolates Over 15,000 Devices

News Editor

2026-09-02 11:41:33

CrowdStrike and the U.S. DOJ announced the dismantling of the Sality peer-to-peer botnet, isolating over 15,000 devices globally. The botnet, active since 2003, used the EggJagger clipboard hijacker to steal at least $150,000 in Bitcoin and Ethereum. The operation involved U.S. and European law enforcement agencies seizing domains and infrastructure. Infected devices are now redirected to CrowdStrike-controlled servers, but the malware remains active until manual removal.

Global Takedown of Sality Botnet Recovers Thousands of Infected Devices

CrowdStrike and the U.S. Department of Justice announced the dismantling of the Sality peer-to-peer botnet, which had been active since 2003. The operation isolated over 15,000 infected devices globally. Over the past eight years, the botnet primarily deployed a clipboard hijacker called EggJagger, designed to steal Bitcoin and Ethereum transfers.

EggJagger monitors victims' copied crypto wallet addresses and replaces them with addresses controlled by attackers, diverting funds. CrowdStrike estimated that the tool alone stole at least $150,000 in crypto assets. Because most of the stolen funds were not moved, the portfolio's value peaked at approximately $1.35 million in January 2025.

The DOJ, FBI, and the Defense Criminal Investigative Service have seized related domains within the U.S., while police in Bulgaria, Hungary, and Romania shut down European infrastructure. Infected devices are now directed to traffic-receiving servers controlled by CrowdStrike, but the original malware remains active on the devices until manually removed.

This article was originally published by Bit.Fan. For more cryptocurrency news and market insights, visit www.bit.fan.

200

Disclaimer:

The market information, project data, and third-party content displayed on this platform are for industry information sharing only and do not constitute any form of investment advice or return commitment.

Cryptocurrency trading carries high risks. Users should fully assess their risk tolerance and make independent decisions. All profits, losses, and legal responsibilities are borne by the users themselves.