Sality

U.S. Departme

2026-09-03 23:00:04

U.S. DOJ says it dismantled the Sality botnet tied to $150,000 in stolen crypto

The U.S. Department of Justice said it has dismantled the Sality botnet in a joint operation with authorities in Bulgaria, Hungary, and Romania, along with cybersecurity firm CrowdStrike. According to U.S. authorities, the botnet had infected about 15,000 devices since 2003 and was used over the past eight years to steal roughly $150,000 in cryptocurrency through a clipboard hijacking tool. CrowdStrike said the malware component, known as EggJagger, monitored wallet addresses copied to users’ clipboards and quietly swapped them with attacker-controlled addresses, allowing funds to be redirected. The firm also said the law enforcement action severed communication channels between the operators and infected devices. It added that the value of the related digital assets had at one point reached a peak of $1.5 million. The item was cited by Techub, which referenced Cointelegraph.

530

US Department

2026-09-02 21:27:15

US Justice Department and CrowdStrike move against Sality malware tied to crypto theft

US federal authorities, working with cybersecurity firm CrowdStrike and international partners, said they disrupted the Sality botnet and related malware linked to cryptocurrency theft and other cyberattacks. The Justice Department said the effort involved officials in Bulgaria, Hungary and Romania, along with private-sector partners CrowdStrike and the Shadowserver Foundation. According to CrowdStrike, operators behind Sality used EggJagger over the past eight years, a clipjacking tool that monitored copied wallet addresses and silently replaced them with addresses under the attackers’ control. The company said the campaign stole at least 12.1 million rubles, or about $150,000, in cryptocurrency. It also said the value of the digital assets that were never spent reached about $1.5 million in January 2025. Authorities and CrowdStrike added that the disruption caused the operators to lose the ability to communicate with infected machines. Roughly 15,000 compromised computers were part of a peer-to-peer botnet that checked whether its systems were online every 40 minutes.

520

Sality

2026-09-02 11:32:37

Sality botnet dismantled after years of hijacking Bitcoin and Ethereum payments

CrowdStrike and the U.S. Department of Justice said they have disrupted Sality, a botnet that has been circulating since 2003 and spent the past eight years stealing cryptocurrency payments by swapping wallet addresses on infected computers. According to CrowdStrike, Sality mainly served as a delivery system for other malware, with EggJagger becoming its primary payload during that period. The security firm described EggJagger as a clipjacking tool that watches the clipboard for crypto wallet addresses and replaces them with addresses controlled by the operator, causing victims attempting to send Bitcoin or Ethereum to redirect funds to someone else instead. CrowdStrike estimated that EggJagger alone brought in at least 12.1 million rubles, or about $150,000. It also said most of the stolen coins were never spent, and that the untouched holdings reached a peak value of about 147 million rubles in January 2025, equal to a nominal $1.35 million. Authorities in the U.S., Bulgaria, Hungary, and Romania took part in the takedown, while CrowdStrike said it isolated more than 15,000 infected machines worldwide by redirecting them to sinkholes under its control.

1240