CrowdStrike và các cơ quan liên bang tiêu diệt phần mềm độc hại của Nga ăn cắp tiền điện tử trong 8 năm

The Huoxing Finance report states that the U.S. cybersecurity firm CrowdStrike, in collaboration with federal law enforcement agencies, recently dismantled the Sality botnet of Russian origin. This malware has been operational since 2003 and has continuously hijacked cryptocurrency payments on infected computers over the past eight years. Its core payload, known as EggJagger, monitors the clipboard and replaces any text resembling Bitcoin or Ethereum addresses with addresses controlled by the attackers. Victims unknowingly send funds to the attackers when pasting transaction addresses. Sality has no central server that can be seized; infected devices communicate directly with each other, checking for peer availability every 40 minutes and spreading via network shares and USB drives. CrowdStrike exploited a security flaw in this mechanism by replacing its server with legitimate peer addresses, severing connections for over 15,000 infected devices. The operation was demonstrated live at the CrowdStrike Day Zero summit in Las Vegas on Monday, with the U.S. Department of Justice stating the action was based on Russian infrastructure. CrowdStrike estimates that the attackers stole at least 12.1 million rubles (approximately $150,000) over eight years, with most of the stolen cryptocurrency remaining untouched. As cryptocurrency prices rose, the value of these unspent assets reached approximately $1.35 million in early 2025. Authorities urge users to verify the first and last characters of cryptocurrency addresses after pasting them to prevent such clipboard hijacking attacks.