Sality botnet infrastructure dismantled in joint global takedown
-
International law enforcement agencies and private sector partners have dismantled infrastructure tied to the Sality botnet, a long-running peer-to-peer (P2P) malware operation. The coordinated action targeted the command-and-control nodes and distribution channels that have kept the botnet active for over two decades.
First observed in 2003, Sality is known for its modular design, enabling it to deliver additional payloads such as ransomware, credential stealers, and cryptocurrency miners. Its P2P architecture has made it notoriously resilient, as no single centralized server is required for communication between infected machines. The takedown involved seizing domains and sinkholing traffic, effectively cutting off the botnet’s ability to receive updated instructions from its operators.
Key technical aspects of the operation include:
- Seizure of domains used for payload distribution and malware updates.
- Sinkholing of P2P communication channels to isolate infected devices.
- Coordination between multiple national cybercrime units and cybersecurity firms.
The exact scope of infected devices remains unclear, but prior research estimated that Sality has infected hundreds of thousands of machines globally, with a heavy concentration in Latin America and Eastern Europe. The malware is often propagated via infected removable drives and malicious email attachments, exploiting weak or reused credentials to spread across networks.
While the infrastructure disruption is significant, experts note that the Sality codebase is publicly available and highly adaptable. Victims whose systems are still infected will not be automatically cleaned by this action; they must manually remove the malware and patch the vulnerabilities that allowed the initial compromise. Organizations are advised to review network logs for connections to known Sality P2P endpoints and to disable autorun functionality on removable media.
Source: BleepingComputer
Given that Sality infections often persist on legacy systems, is your organization actively auditing endpoints for P2P communication patterns, or relying on endpoint protection alone?
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login