US Authorities and CrowdStrike Dismantle 20-Year-Old Russian 'Sality' Botnet

A two-decade-old Russian hacking operation known as the "Sality" botnet is being dismantled in a coordinated effort by U.S. law enforcement and cybersecurity firm CrowdStrike. The joint operation marks a significant disruption of one of the internet's longest-running cybercriminal enterprises, which was used to send spam, conduct denial-of-service attacks, and steal cryptocurrency.

Coordinated Takedown Operation

The U.S. Justice Department and the FBI announced on Tuesday that they had seized web domains used by the hackers to control the botnet. In a parallel action, CrowdStrike said it had successfully severed the network of compromised computers from its central controller. The company demonstrated the initial phase of the takedown live on Monday at its Day Zero threat intelligence summit.

In statements, U.S. officials confirmed the operation was carried out with European law enforcement and other partner organizations. "Cybercriminals, botnets, and malware are a clear and present danger to our nation’s security and economy,” said First Assistant U.S. Attorney Bill Essayli, highlighting the economic and security risks posed by such networks.

Deconstructing a Resilient Threat

First identified in 2003, the Sality botnet proved remarkably resilient for years due to its peer-to-peer (P2P) architecture. This decentralized structure allowed it to receive commands through a diffuse network of infected machines, making it difficult for law enforcement to disable.

Ad

CrowdStrike explained in a blog post that its team turned this strength into a weakness. After reverse-engineering the botnet's structure, they seeded the network with counterfeit information that tricked the infected computers into cutting themselves off from their creator. "This was the most complex botnet takeover we have ever done," CrowdStrike researcher Tillmann Werner told Reuters. "It was built to survive takedown or takeover."

Implications for Cybersecurity

While overshadowed in recent years by more aggressive ransomware groups, Sality remained a persistent threat. David Watson, a director at the nonprofit security group The Shadowserver Foundation, which assisted in the effort, described Sality as "quite old-school" but noted it was "still a vector into a lot of organizations."

The disruption reduces a long-standing source of cyber risk for businesses worldwide. However, the operation's long-term success is not yet guaranteed. The botnet's creator has not been publicly identified, and experts will be monitoring for any attempts to regain control or rebuild the network.