US Officials and CrowdStrike Dismantle 20-Year-Old Russian 'Sality' Botnet

A coordinated international effort is dismantling one of the internet's longest-running cybercriminal operations, according to U.S. law enforcement and cybersecurity firm CrowdStrike. The target is the 'Sality' botnet, a Russian-based network that has been active for approximately two decades.

The Takedown Operation

The U.S. Justice Department and the FBI announced on Tuesday that they had seized web domains used by the Sality operators to control infected computers. In a parallel action, CrowdStrike said it had successfully severed the network of compromised computers from its mastermind, beginning the final phase of the disruption live on Monday at its Day Zero threat intelligence summit in Las Vegas.

The operation was conducted in coordination with European law enforcement and other security organizations. "Cybercriminals, botnets, and malware are a clear and present danger to our nation’s security and economy,” First Assistant United States Attorney Bill Essayli said in a statement.

A Resilient, Long-Running Threat

First identified in 2003, the Sality botnet is a veteran of the cybercrime landscape. The network was used for a variety of malicious activities, including sending spam, conducting distributed denial-of-service (DDoS) operations, and stealing cryptocurrency.

According to security experts, Sality's peer-to-peer architecture made it particularly resilient against law enforcement actions for years. This structure allowed it to receive commands through a diffuse network of infected machines rather than a single, vulnerable command center.

Ad

A Novel Disruption Technique

CrowdStrike detailed in a blog post how it turned the botnet's own resilient design against it. Researchers seeded the network with counterfeit information, which tricked the infected computers into cutting themselves off from their creator's control.

"This was the most complex botnet takeover we have ever done," CrowdStrike researcher Tillmann Werner told Reuters. "This was built to be resilient. It was built to survive takedown or takeover. I think that’s the reason it’s been around for so long."

What's Next

The Justice Department stated the operation was based out of Russia but did not provide further details on the individuals behind it. The successful takedown neutralizes a persistent threat, but experts are now watching to see if Sality's creator, who remains unidentified, will attempt to rebuild the network.

David Watson, a director at the nonprofit security group The Shadowserver Foundation, which assisted in the effort, described Sality as "quite old-school" but still a dangerous "vector into a lot of organizations." He added the key question now is, "Does he fight back?"