SURIQ
A botnet does not die when its control network goes dark. That is the practical lesson of this week's disruption of Sality, a peer-to-peer botnet that has run quietly since 2003. Investigators broke the operator's grip on more than 15,000 infected machines, but the malware is still sitting on every one of them. The action buys defenders time. It does not clean a single endpoint.
If you run older or lightly monitored Windows hosts, the work starts now, not when the press release lands.
What actually happened
On September 1, the US Justice Department announced a multinational operation against Sality, a botnet being a network of hacked computers steered as one. The US side pulled in the FBI and the Defense Criminal Investigative Service, and authorities in Bulgaria, Hungary, and Romania acted against Sality-linked domains hosted in Europe. Two private partners did the technical heavy lifting: CrowdStrike and the Shadowserver Foundation.
The method targeted the botnet's own design. According to CrowdStrike's account, reported by The Register, every Sality bot keeps a list of reachable "super peers" and checks in roughly every 40 minutes. The operation stripped the genuine peers out of those lists and fed in sinkhole entries, so infected machines slowly lost the ability to reach the operator. Shadowserver is now working with internet providers and national response teams to notify the owners of infected hosts.
A 23-year-old file infector, repurposed
Sality is old, and its age is the story.
CrowdStrike's profile of the operator, which it tracks as SALTY SPIDER and assesses likely operates out of Russia, dates the malware to 2003. It began as a polymorphic file infector, a virus that rewrites other programs so it spreads on its own. By mid-2017 the count of infected hosts climbed sharply once the malware started abusing EternalBlue, the same Windows file-sharing exploit that powered WannaCry (tracked as MS17-010). Around that point the operator dropped its older proxy and spam work and turned to stealing cryptocurrency.
For roughly the last eight years the main payload has been a clipboard hijacker called EggJagger. It watches for a copied Bitcoin or Ethereum address and silently swaps in the attacker's wallet, so a victim who pastes an address to send a payment funds the criminal instead. CrowdStrike estimates at least $150,000 was stolen through EggJagger alone. That is a modest haul for a two-decade operation, which tells you the real value of Sality was never one payload: it was a durable foothold on thousands of machines that could carry whatever paid best that year. Clipboard hijackers are their own malware class, and this one will keep running on any host that stays infected.
The gap a takedown leaves
Here is the part that does not fit in a headline. A sinkhole cuts the operator's leash, but the malware is still in the house. Sality self-propagates and persists locally, so isolating a bot from its network does not uninstall it. Until each endpoint is actually cleaned, it can keep swapping crypto addresses, and a repurposed file infector can pick up a fresh payload the moment anyone regains control of it.
We have seen this shape before. When a proxy botnet was disrupted earlier and the devices stayed infected, the disruption was real but the cleanup was left to defenders. Sality is the same situation on a longer timeline. The notification from Shadowserver is not the end of your incident. It is the start of one.
What to do this week
-
Treat any notice as a confirmed infection. If Shadowserver, your provider, or a national response team flags one of your addresses, that host is infected. Clean it to a known-good state or rebuild it, and do not assume the takedown handled it.
-
Hunt your oldest Windows estate. The machines most likely to carry a 23-year-old infector are the ones nobody watches: legacy servers, forgotten workstations, appliances. Look for unexpected peer-to-peer traffic on non-standard ports, tampering with running executables, and clipboard content being rewritten.
-
Audit internal MS17-010 exposure. Sality grew on EternalBlue in 2017, and anything still exposed to that flaw internally is a red flag well beyond this one botnet. Find and close it.
-
Verify wallet addresses out of band. A clipper makes the address on your screen untrustworthy. For any crypto payment, confirm the destination through a second channel before you send, at least until you are sure no involved machine is infected.
The defender's view
The residual infections a takedown leaves behind are exactly the kind of thing a continuously monitored fleet is meant to catch: changes to system binaries, unexpected outbound connections, and hosts still carrying old file-sharing flaws all read as signals instead of surprises. That is the posture Suriq is built around, watching the servers you actually run and surfacing the odd behavior rather than waiting for an external notice. A botnet disruption is a good prompt to check that the visibility is there before the next one lands.