International Operation Disrupts Sality P2P Botnet

A US-led international law-enforcement operation, supported by Europol and private partners CrowdStrike and Shadowserver, disrupted the Sality P2P botnet that has operated for over 20 years and at its peak infected hundreds of thousands to millions of machines. The disruption relied on sinkholing via protocol-level manipulation of peer verification—removing legitimate peers from bots' lists and inserting sinkhole entries—to track and notify victims and aid remediation across multiple jurisdictions.