The US Department of Justice has announced the completion of a multinational operation to dismantle the Sality botnet — one of the oldest active P2P threats, operating since 2003. The operation, carried out on August 31, 2026, by law enforcement agencies in the United States, Bulgaria, Hungary, and Romania with the participation of CrowdStrike and the Shadowserver Foundation, included seizing control of the P2P network via a sinkhole mechanism and confiscating associated domains in the US and Europe. Organizations using Windows infrastructure are advised to check network logs for signs of infection — existing malware on compromised machines remains active and requires removal.
What Sality Is
Sality is a polymorphic file infector that infects Windows executable files and spreads via network shares, USB devices, email, and compromised websites. Its key feature is a decentralized P2P command-and-control architecture, which allowed the botnet to bypass traditional neutralization methods based on taking down central command-and-control (C2) servers. According to a statement by the Department of Justice, the botnet was used to steal cryptocurrency and conduct cyberattacks against victims in the United States and abroad.
Historical CISA reports describe Sality as a threat that spreads via open file shares and connected storage devices, capable of disabling security software and installing additional malicious components to steal credentials. CISA has also described Sality as a polymorphic file infector with a decentralized update infrastructure.
Attribution and Threat Context
According to a joint 2022 CISA advisory, the development and operation of the Sality botnet is carried out by the cybercriminal group SALTY SPIDER. Although the botnet’s primary activity was financially motivated, CISA recorded a DDoS campaign in February 2022 against Ukrainian web forums discussing the Russian military offensive on Kharkiv. This indicates the operators’ willingness to use the botnet infrastructure for political purposes as well.
It is important to note that CISA’s attribution is historical in nature and does not establish a direct link between any specific individual or organization and the operation that was neutralized in September 2026.
Takedown Mechanism
The operation leveraged a fundamental weakness in the Sality P2P protocol: the lack of authentication, cryptographic identification of participants, and any mechanism for verifying the legitimacy of nodes. Any publicly reachable machine that correctly responded to the P2P handshake was accepted by the network as a legitimate participant. According to researchers, this architectural vulnerability made it possible to carry out the takeover operation.
In parallel with the takeover of the P2P network, domains used to host Sality payloads were seized. Domains were confiscated both in the US and in Europe with the assistance of law enforcement authorities in Bulgaria, Hungary, and Romania.
The Shadowserver Foundation is working with internet service providers and incident response teams to identify Sality infections and help notify victims and remediate the impact.
Strategic Context
The Department of Justice frames the operation as an implementation of the first pillar of President Trump’s cyber strategy — “Shape Adversary Behavior,” aimed at identifying and dismantling malicious networks and degrading adversaries’ tools and infrastructure. First Assistant US Attorney Bill Essig highlighted that the successful takedown demonstrates the effectiveness of cooperation between the public and private sectors.
FBI Assistant Director Patrick Grandi noted that cooperation with international law enforcement and private-sector partners enhances the FBI’s ability to neutralize cyber threats.
Detection and Response Recommendations
The dismantling of the P2P infrastructure and seizure of domains prevents the delivery of new malicious payloads; however, malware already installed on infected systems remains active. Organizations should:
- Check network logs and endpoint telemetry for UDP traffic to IP address 188.166.101[.]148 — a match indicates a Sality infection requiring immediate remediation
- Check for connections to the following domains associated with payload delivery:
theunforgiven.p8[.]hu,painelwebradiodigital.awardspace[.]info,sgwebdesigner.free[.]fr,www.yonelco[.]com,pozdravizbeograda[.]com,highclass.atspace[.]com,situluimihai.3x[.]ro,gatheredovertime[.]com,imagebucket[.]biz - Run a full antivirus scan of Windows systems with a focus on the integrity of executable files — Sality spreads by injecting itself into PE files on disk
- Isolate detected infected machines and perform a reinstall or restore from clean backups
The takedown of Sality is a rare example of successfully dismantling a P2P botnet whose architecture was considered resistant to traditional neutralization methods. For organizations, the key action now is not to celebrate the success of the operation but to check their own infrastructure: infected machines still contain active malware, and the only way to eliminate it is to detect it using the listed indicators of compromise and fully clean the affected systems.
