US DOJ and CrowdStrike Take Down Sality Botnet, Stealing Over 12 Million Rubles in Crypto

ChainCatcher report: On Tuesday, CrowdStrike and the U.S. Department of Justice announced the takedown of the Sality peer-to-peer botnet, which has been active since 2003. Over the past eight years, this botnet primarily hijacked cryptocurrency payments through the EggJagger malware, which monitored victims’ clipboard contents for cryptocurrency wallet addresses and replaced them with addresses controlled by the attackers, causing victims to send funds to strangers. CrowdStrike estimates that, through the EggJagger payload alone, the operators stole at least 12.1 million rubles (approximately $150,000). Most of the stolen cryptocurrency remains unspent; CrowdStrike assessed that these idle assets were worth approximately 147 million rubles (roughly $1.35 million) at their peak in January 2025. Sality has persisted this long because it lacks a central server that can be seized—infected machines communicate directly with one another. This multinational operation involved the United States, Bulgaria, Hungary, and Romania. The U.S. Department of Justice, FBI, and Defense Criminal Investigative Service seized Sality-related domains within the United States, while law enforcement agencies across multiple European countries seized additional domains. CrowdStrike exploited architectural vulnerabilities to isolate over 15,000 infected machines into honey pots under its control. The operators have been traced to SALTY SPIDER, who previously launched a denial-of-service attack against the Russian cryptocurrency exchange AvanChange in September 2023.