CyberNew CyberNew
Ransomware & Malware SecurityWeek 1 month ago

23-Year-Old Sality P2P Botnet Disrupted

CN
CyberNew Threat Research Desk
• Original Reporting: SecurityWeek
CyberNew Threat Intel Assessment
Assessed Severity: CRITICAL
Impacted Surface
Enterprise Perimeter & Network Defense
Intelligence Sector
Ransomware & Malware

Analyst Takeaway

"After 23 years of operation, the Sality peer-to-peer (P2P) botnet has been disrupted as part of an international law enforcement effort. First observed in 2003, Sality has been used for distributing various malware families, including information stealers, proxy services, distributed denial-of-service (DDoS) payloads, and more. For the past eight years, it mainly served the EggJagger clipjacking..."

Recommended Defense & Mitigation

  • Emergency Patching: Prioritize vendor patches and CVE mitigation across internet-facing assets immediately.
  • Perimeter Audit: Inspect perimeter firewall logs and hunt for unauthorized RCE indicators.
Curated & Verified by CyberNew Threat Intelligence Desk Standard Defense Framework (NIST / MITRE ATT&CK)
Botnet

After 23 years of operation, the Sality peer-to-peer (P2P) botnet has been disrupted as part of an international law enforcement effort.

First observed in 2003, Sality has been used for distributing various malware families, including information stealers, proxy services, distributed denial-of-service (DDoS) payloads, and more.

For the past eight years, it mainly served the EggJagger clipjacking tool, which is believed to have stolen at least $150,000 in Bitcoin and Ethereum.

Sality remained active due to its architecture: it spread through a file infector, attaching itself to executables on disk and removable media, and did not rely on a central command-and-control (C&C) server for receiving code updates.

The protocol behavior that allowed the botnet to persist for over 20 years was also the weakness that led to its demise: it blindly trusted the peers on the network, without authentication or identity verification.

Sality bots periodically checked if the peers in their list of super peers (infected machines forming the backbone of the P2P network) were accessible. Those that were online built reputation, while those offline lost it and were eventually purged.

Advertisement. Scroll to continue reading.

Exploiting this behavior, CrowdStrike performed protocol-level manipulation of the list, removing the super peer entries to progressively isolate infected machines, while injecting sinkholes into the list.

Written By Ionut Arghire

Source Verification & Original Intelligence

This threat report was reviewed by CyberNew analysts and cross-referenced with primary security disclosures from SecurityWeek.

Primary Advisory →