CrowdStrike and U.S. Federal Agencies Shut Down Russian Malware That Stole Cryptocurrency for Eight Years

Huo Xing Cai Jing reports that the U.S. cybersecurity firm CrowdStrike, in collaboration with federal law enforcement agencies, recently dismantled the Russian-linked Sality malware botnet. This malware has been active since 2003 and has consistently hijacked cryptocurrency payments on infected computers over the past eight years. Its core payload, known as EggJagger, monitors the clipboard and replaces any text resembling Bitcoin or Ethereum addresses with addresses controlled by the attackers. Victims unknowingly send funds to the attackers when pasting transaction addresses. Sality has no central server that can be seized; infected devices communicate directly with each other, checking for peer availability every 40 minutes and spreading via network shares and USB drives. CrowdStrike exploited a security flaw in this mechanism by replacing the server with legitimate peer addresses, disconnecting over 15,000 infected devices from the network. The operation was demonstrated live at the CrowdStrike Day Zero summit in Las Vegas on Monday, with the U.S. Department of Justice stating the action was based on intelligence related to Russia. CrowdStrike estimates that the attackers stole at least 12.1 million rubles (approximately $150,000) over eight years; most of the stolen cryptocurrency remained untouched, and as prices rose, the value of these unspent assets reached approximately $1.35 million in early 2025. Authorities urge users to verify the first and last characters of cryptocurrency addresses after pasting them to guard against such clipboard hijacking attacks.