In a major international law enforcement operation, the Sality hacking network, one of the world\u2019s oldest and most persistent peer-to-peer (P2P) botnets, has finally been taken down after nearly a quarter of a century. First spotted by experts in 2003, the malicious system has been used to spread various forms of malware over the years, including data-stealing tools, proxy services, and software to carry out denial-of-service attacks.<\/p>\n\n\n\n
Over the past eight years, the network has been primarily used to spread the EggJagger tool, a specialized clipboard replacement code that is estimated to have netted attackers at least \u20ac132,800 in bitcoin and ethereum cryptocurrencies.<\/p>\n\n\n\n
The key to Sality's incredible longevity was its architecture. It spread like a classic file infector, attaching itself to executable files on hard drives and removable media. Because it did not rely on a single central command server to update its code, it was extremely difficult to completely disable.<\/p>\n\n\n\n
Ironically, the very protocol that had enabled the network to survive for more than 20 years also became its greatest weakness. The network blindly trusted all connected computers without verifying their identities or requiring any authentication. Infected devices, or bots, regularly checked the reachability of other devices on their list of so-called superlinks that formed the backbone of the P2P network. Computers that were reachable gradually gained trust, while those that were unreachable were eventually removed from the list.<\/p>\n\n\n\n
This specific behavior was exploited by experts from CrowdStrike. Using protocol-level manipulation, they gradually removed legitimate superlink entries from the lists, isolating infected computers. At the same time, they redirected traffic in the system to their own fake servers, or sinkhole servers.<\/p>\n\n\n\n
In a coordinated effort with law enforcement agencies in the United States, Bulgaria, Hungary, and Romania, they then seized and removed the websites hosting the malicious files, preventing the infected devices from receiving any further updates. This effectively prevented the criminals operating the Sality network from communicating with the infected computers, as the devices were now redirected to CrowdStrike\u2019s secure infrastructure.<\/p>\n\n\n\n
As part of the operation, The Shadowserver Foundation is working with Internet service providers and national Cybersecurity Response Teams (CSIRTs) to identify all victims and assist in the complete cleanup of their computers.<\/p>","protected":false},"excerpt":{"rendered":"
V obse\u017eni mednarodni operaciji organov pregona je bila po skoraj \u010detrt stoletja delovanja kon\u010dno prekinjena hekerska mre\u017ea Sality, ena najstarej\u0161ih in najbolj trdovratnih vrstni\u0161kih (P2P) botmre\u017e na svetu. Ta zlonamerni sistem, ki so ga strokovnjaki prvi\u010d opazili \u017ee leta 2003, je skozi leta slu\u017eil za \u0161irjenje razli\u010dnih oblik zlonamerne programske opreme. Med njimi so bila […]<\/p>","protected":false},"author":2,"featured_media":0,"comment_status":"","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[],"tags":[478,482],"class_list":["post-8115","post","type-post","status-publish","format-standard","hentry","tag-informacijska-varnost","tag-kibernetska-varnost"],"acf":{"subtitle":"","heading":"","summary":"Po 23 letih je mednarodna policijska akcija onemogo\u010dila P2P botnet Sality. Z izkori\u0161\u010danjem pomanjkljivosti v protokolu zaupanja so varnostni strokovnjaki osamili oku\u017eene ra\u010dunalnike in prepre\u010dili nadaljnje \u0161irjenje zlonamerne kode.","thumbnail_small":"https:\/\/racunalniske-novice.com\/wp-content\/uploads\/2026\/08\/cliff1126-hacker-8018499_1920-560x315.png","thumbnail_large":"https:\/\/racunalniske-novice.com\/wp-content\/uploads\/2026\/08\/cliff1126-hacker-8018499_1920-1024x574.png","thumbnail_caption":"Foto: Pixabay","gallery":"","video_gallery":null,"author":"","links":null,"sources":[{"title":"securityweek","url":"https:\/\/www.securityweek.com\/23-year-old-sality-p2p-botnet-disrupted\/"}],"skip_language":[]},"yoast_head":"\n