Bộ Tư pháp Hoa Kỳ và CrowdStrike tiêu diệt botnet Sality, đánh cắp hơn 150.000 USD tiền điện tử

The Huoxing Finance report states that on Tuesday, CrowdStrike and the U.S. Department of Justice announced the takedown of the Sality peer-to-peer botnet, which has been active since 2003. Over the past eight years, this botnet primarily hijacked cryptocurrency payments through the EggJagger malware, which monitored victims’ clipboard for cryptocurrency wallet addresses and replaced them with the operators’ own addresses, causing victims to send funds to strangers. CrowdStrike estimates that, through the EggJagger payload alone, the operators stole at least 12.1 million rubles (approximately $150,000). Most of the stolen cryptocurrencies remain unspent; CrowdStrike assessed that these unused assets were worth approximately 147 million rubles (nominally about $1.35 million) at their peak in January 2025. Sality has survived this long because it lacks a central server that can be seized—infected machines communicate directly with each other. This multinational operation involved the United States, Bulgaria, Hungary, and Romania. The U.S. Department of Justice, FBI, and Defense Criminal Investigative Service seized Sality-related domains within the United States, while police in multiple European countries seized additional domains. CrowdStrike exploited architectural vulnerabilities to isolate over 15,000 infected machines into honeypots under its control. The operators have been traced as SALTY SPIDER, who previously launched a denial-of-service attack against the Russian cryptocurrency exchange AvanChange in September 2023.