Sality botnet infrastructure dismantled in joint global takedown

International law enforcement and private partners, including the DOJ, FBI, Europol, Eurojust, and CrowdStrike, conducted a coordinated operation to seize Sality-related domains and sinkhole the botnet's P2P super peers, disrupting two active Sality networks that had been used for over two decades to deliver various malware families. CrowdStrike attributes the botnet to a criminal group tracked as SALTY SPIDER and notes primary recent use for EggJagger clipjacking (clipboard replacement of cryptocurrency addresses); the action isolated infected machines and removed operator control.