CrowdStrike and Law Enforcement Take Down 20-Year-Old Russian Cryptojacking Botnet Sality

According to CoinDesk, the U.S. cybersecurity firm CrowdStrike, in collaboration with federal law enforcement agencies, successfully dismantled Sality, a Russian botnet operating for over two decades. For nearly eight years, the botnet has been stealing cryptocurrencies through a "clipboard hijacking" scheme—its core payload, "EggJagger," lies dormant on infected machines, monitoring the user’s clipboard and replacing any detected Bitcoin or Ethereum wallet addresses with the attacker’s own address, causing victims to unknowingly send funds to the wrong destination. Sality employs a decentralized P2P architecture with no central server, checking node connectivity every 40 minutes and spreading via network shared drives and USB devices. CrowdStrike exploited a vulnerability in its authentication mechanism, replacing legitimate node addresses with its own servers, thereby severing network connections for over 15,000 infected machines. The operation was demonstrated live at the Day Zero conference in Las Vegas. Estimates suggest the attackers stole at least 12.1 million rubles (approximately $150,000) over eight years. Due to market appreciation, some of the undisturbed crypto assets had risen in value to approximately $1.35 million by early 2025. Security experts advise users to always verify the first and last characters of any wallet address after pasting it to guard against such attacks.