Peer Pressure: Inside the Sality Botnet Disruption Operation
ID: ef27c558-1f08-54f2-86fd-836bb15c8f16
STIX ID: report--ef27c558-1f08-54f2-86fd-836bb15c8f16
Feed Name: Crowdstrike Blog
Date Published: 2026-09-01
Date Updated: 2026-09-05
Author: CrowdStrike Counter Adversary Operations
CrowdStrike and international partners executed a disruption operation against the long-running Sality P2P botnet by manipulating peer lists and injecting sinkholes, combined with coordinated takedowns of payload-hosting URLs; the report provides a lighthouse IP, last-seen URL packs, and YARA rules to detect active infections and instructs defenders to remediate remaining compromised hosts.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.
