CrowdStrike and U.S. Federal Agencies Take Down 8-Year-Old Russian Crypto-Stealing Malware

ChainCatcher report: The U.S. cybersecurity firm CrowdStrike, in coordination with federal law enforcement agencies, recently dismantled the Russian-linked Sality malware botnet. This malware has been active since 2003 and has consistently hijacked cryptocurrency payments on infected computers over the past eight years. Its core payload, known as EggJagger, monitors the clipboard and replaces any text resembling Bitcoin or Ethereum addresses with addresses controlled by the attackers. Victims unknowingly send funds to the attackers when pasting transaction addresses. Sality has no central server to seize; infected devices communicate directly with each other, checking peer connectivity every 40 minutes and spreading via network shares and USB drives. CrowdStrike exploited a security flaw in this mechanism by replacing the server with legitimate peer addresses, severing connections for over 15,000 infected devices. The operation was demonstrated live at the CrowdStrike Day Zero summit in Las Vegas on Monday. The U.S. Department of Justice stated the action was based on intelligence related to Russia. CrowdStrike estimates that the attackers stole at least 12.1 million rubles (approximately $150,000) over eight years; most of the stolen cryptocurrency remained untouched, and as prices rose, the value of these unspent assets reached approximately $1.35 million in early 2025. Authorities urge users to verify the first and last characters of cryptocurrency addresses after pasting them to guard against such clipboard hijacking attacks.