CrowdStrike Disrupts Sality Botnet After More Than 20 Years

CrowdStrike, working with international law enforcement and industry partners, disrupted the Sality peer-to-peer botnet on Aug. 31 by manipulating its unauthenticated peer lists and replacing legitimate super peers with sinkholes, effectively cutting the alleged operator's control of over 15,000 infected machines; Sality had persisted for 20+ years, spread via infected executables and removable media, and was used to deliver payloads (notably EggJagger clipboard stealer) and occasional DDoS campaigns.