Sality Botnet Takedown Ends a 23-Year P2P Malware Run

Twenty-Three Years, Then a Peer List

On August 31, 2026, CrowdStrike's Counter Adversary Operations team and a coalition of international law enforcement agencies severed the Sality botnet's operator from every machine still under their control. The disruption was made public on September 2. Sality had been running since roughly 2003 — 23 years, more than 11 million unique IP addresses associated with its infrastructure over that span, and around 15,000 machines still reachable at the time of the operation.

• Duration: Sality operated for 23 years, with over 11 million unique IPs linked to its infrastructure across that period
• Scale at takedown: roughly 15,000 infected machines were still receiving payloads from the operator
• Method: peer-to-peer sinkholing — defenders replaced legitimate super peers in each bot's peer list with their own servers
• Coalition: CrowdStrike with Europol and Eurojust support, the US DOJ, FBI and DCIS, plus authorities in Bulgaria, Hungary and Romania seizing domains

Why Peer-to-Peer Botnets Are Hard to Kill

Most botnet takedowns work by removing the meeting point. Seize the command-and-control domains, sinkhole the IP addresses the malware calls home to, and the bots have nobody to talk to. That approach fails against a peer-to-peer design, because there is no single meeting point to seize. Every infected machine knows about other infected machines, and the operator injects commands anywhere in the mesh.

This is exactly why Sality survived so long. It has no central server to point a warrant at. Removing any individual node does nothing — the network routes around it, which is the property that made P2P architectures attractive to defenders and, unfortunately, to whoever built this.

How Defenders Turned the Peer List Against Itself

The operation targeted the one data structure every bot must maintain: its list of super peers. Super peers are publicly reachable infected machines that form the backbone of the network — the nodes everyone else uses to stay connected and to receive fresh payloads.

Bots continuously refresh that list, discarding peers that stop responding and adopting new ones that do. Researchers exploited exactly that maintenance behaviour: they systematically invalidated the legitimate super peers and supplied defender-controlled sinkholes in their place. Bot by bot, each infected machine's view of the network was replaced with a view containing only servers run by the people trying to shut it down.

The result is that the command channel is inert. Infected machines still run the malware, but the operator's instructions no longer reach them. It is an elegant inversion — the resilience mechanism that made Sality hard to kill is the mechanism that killed it.

Alongside the technical work, the DOJ, FBI and DCIS seized Sality-linked domains in the United States, while authorities in Bulgaria, Hungary and Romania seized additional domains hosted in Europe, with Europol and Eurojust coordinating across jurisdictions.

What Sality Was Actually Doing

Sality functioned primarily as a distribution platform — a loader that other criminal operations paid to deliver their payloads onto already-compromised machines. In its later years that included clipboard-hijacking components that silently substituted attacker-controlled wallet addresses when a victim copied a cryptocurrency address, a technique that reportedly ran for around eight years.

That is the quiet lesson here. A 23-year-old commodity infection is not a headline threat, and it does not generate incident reports. It just sits there, sold as access, waiting for whichever campaign rents it next.

What Defenders Should Take From This

Three things stand out for anyone running a security programme:

• Old infections are still infrastructure. A machine compromised years ago and never remediated is a live asset in someone's business model. Legacy endpoints deserve scanning attention, not just patching attention.
• Architecture-aware disruption works. The win here came from understanding Sality's peer-maintenance logic well enough to abuse it. That is research work, and it is what makes these operations possible at all.
• Coordination is the multiplier. Domains in four countries, a private research team, and three US agencies — the same shape as previous successes like the Europol operation that dismantled the SocksEscort botnet across 369,000 routers and the coalition that took down four IoT botnets spanning 3 million devices.

If you administer endpoints that have been in service for a decade or more, this is a good week to check them. Our AI security coverage will follow the remediation guidance as national CERTs publish victim notifications.

Sources: BleepingComputer — September 2, 2026; The Register — September 2, 2026; CrowdStrike — Inside the Sality Botnet Disruption Operation — September 2026; US Department of Justice — September 2026.