logo

Peer Pressure: Inside the Sality Botnet Disruption Operation

ID: ef27c558-1f08-54f2-86fd-836bb15c8f16

STIX ID: report--ef27c558-1f08-54f2-86fd-836bb15c8f16

Feed Name: Crowdstrike Blog

Threat Score
75/100

Date Published: 2026-09-01

Date Updated: 2026-09-05

Author: CrowdStrike Counter Adversary Operations

...
...

CrowdStrike and international partners executed a disruption operation against the long-running Sality P2P botnet by manipulating peer lists and injecting sinkholes, combined with coordinated takedowns of payload-hosting URLs; the report provides a lighthouse IP, last-seen URL packs, and YARA rules to detect active infections and instructs defenders to remediate remaining compromised hosts.

Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.