Overview

On August 31, 2026, the U.S. Department of Justice, FBI, and Defense Criminal Investigative Service, working alongside law enforcement in Bulgaria, Hungary, and Romania, and in partnership with CrowdStrike's Counter Adversary Operations team and the Shadowserver Foundation, disrupted Sality — a decentralized peer-to-peer (P2P) botnet that had operated largely unchallenged since 2003. Public reporting on the operation, and the DOJ's own announcement, landed September 1-2, 2026, the same window intel surfaced a set of Sality-linked FQDNs and payload URLs from raw OSINT feeds.

Sality is not a new name. It is one of the longest-running pieces of malware infrastructure ever tracked: a polymorphic Windows file infector that built its resilience not around a conventional command-and-control server, but around a fully decentralized P2P mesh of infected "super peers." That architectural choice is exactly what made Sality durable for two decades, and it is exactly what investigators exploited to take it down. Instead of seizing a server, they poisoned the network's own peer-discovery mechanism from the inside — the same general technique class used against GameOver Zeus in 2014 and Kelihos in 2017.

Background: What Sality Is

Sality is a polymorphic file-infector first identified in 2003 (some reporting rounds this to "20-year-old," most to "23-year-old" as of the 2026 takedown; sources are not perfectly consistent on the exact origin year, but all agree it predates 2005). Unlike malware that relies on a central C2 server for updates and tasking, Sality propagates by infecting executable files directly on disk and spreading via removable media and network shares — a mechanism that cannot be "patched" or centrally disabled the way a C2 domain can.

Over its lifetime, Sality's operators used the botnet as a general-purpose criminal platform: credential theft, spam relay, proxy-as-a-service, distributed denial-of-service capability, and — most relevant to the current disruption — a delivery channel for secondary payloads pushed out over the bot's own P2P network. Reporting on the takedown describes two independent, simultaneously active P2P protocol variants at the time of disruption, referred to as version 3 and version 4. Per CrowdStrike's Counter Adversary Operations team, the two variants "shared the same codebase and were operated by the same threat actor, but used incompatible protocol versions and different cryptographic keys" — in effect, two forks of the same criminal infrastructure running in parallel, together reported to span more than 15,000 infected machines worldwide.

Technical Breakdown: How the Takedown Worked

Stage 1 — The Peer List as an Attack Surface

Every Sality bot maintains a locally cached peer list: a set of known "super peers," meaning other infected, publicly reachable machines that form the backbone nodes of the P2P mesh. Ordinary bots use this list to discover the network and receive tasking, including instructions to fetch new payloads. Per public reporting, each bot re-checks the liveness of its listed peers on a roughly 40-minute cycle.

That liveness-check cycle is the mechanism investigators targeted. Because the peer list is just data the bot trusts and periodically refreshes, an operation with enough presence on the network can influence what a given bot believes its peer set is.

Stage 2 — Poisoning and Sinkholing

CrowdStrike's Counter Adversary Operations team performed protocol-level manipulation of bots' peer lists: systematically removing legitimate super-peer entries and inserting purpose-built sinkhole entries under CrowdStrike's control in their place. As this propagated across the mesh, infected machines were progressively cut off from operator-controlled infrastructure and instead began beaconing to sinkhole nodes. Because new payload delivery in Sality depends on the P2P channel, this had the direct effect of blocking distribution of any new payloads to the infected population — without requiring physical or legal seizure of every peer.

Stage 3 — Domain Seizure

In parallel with the network-level sinkholing, the DOJ, FBI, and DCIS seized Sality-linked domains hosted in the United States, while law enforcement partners in Bulgaria, Hungary, and Romania took equivalent action against Sality-linked domains hosted in Europe. This closed off the HTTP-based payload-hosting side of the operation (the kind of plain domain/URL payload-delivery infrastructure reflected in STR's own IOC feed) alongside the P2P-layer disruption.

Stage 4 — What the Takedown Does Not Fix

Because Sality's propagation mechanism is file infection rather than a remotely-triggered install, sinkholing the P2P layer and seizing payload domains does not disinfect a single already-compromised host. Every previously infected machine remains infected, remains capable of re-infecting files it touches (including removable media and shares), and will continue attempting to reach peer infrastructure — now largely sinkholed, but not guaranteed to stay that way if the operator stands up replacement infrastructure. Shadowserver is reported to be coordinating with ISPs and national CSIRTs to identify and notify victim organizations, which is the realistic long pole in actually reducing the infected population.

Timeline

Detection Guidance

The takedown addresses new-payload delivery and network-level C2, not on-host infection. Detection should assume some organizations still have infected, unremediated hosts.

Network Layer

• Legacy/brief-sourced IOC domains and URLs. Alert on and block resolution of/connections to any Sality-linked domains or URLs from current threat feeds, including the specific set surfaced in STR's 2026-09-02 daily brief (www.yonelco[.]com, pozdravizbeograda[.]com, theunforgiven.p8[.]hu, gatheredovertime[.]com, imagebucket[.]biz, forex2030[.]com). Treat hits as probable indicators of a residual infected host, not necessarily live attacker activity, since much of this infrastructure may now be sinkholed or seized.
• Anomalous P2P-style traffic patterns. Sality's mesh communication looks like a host making frequent, short-lived outbound connections to a changing, diverse set of external IPs on non-standard/high ports, roughly every 40 minutes per peer-list refresh behavior. This pattern, especially from a workstation with no legitimate P2P application inventory, is a strong behavioral signal independent of any specific IOC.
• DNS/HTTP requests for payload-style paths. The brief's own IOCs follow a pattern of short, non-descriptive paths on unrelated-looking domains (/img/top.gif, /nb4, /nv4, /readme.pdf) — consistent with historical Sality payload-staging conventions. Generic detections for HTTP GETs retrieving executable content from URLs with mismatched content-type/extension are a reasonable complementary control.

Process/Host Layer (EDR)

• File-infection behavior. Sality's core propagation mechanic is modifying legitimate PE files on disk (altering entry points to redirect to injected code). EDR/AV heuristics for unexpected modification of multiple unrelated executables in a short window, especially outside of a software update/install context, are a high-value detection for this malware family specifically (as opposed to most modern malware, which drops new files rather than infecting existing ones).
• Process injection into long-lived system processes. Sality is historically associated with injecting into processes such as services.exe and explorer.exe to persist without a standalone visible malware process. Sysmon Event ID 8 (CreateRemoteThread) or equivalent EDR injection telemetry targeting these processes from an unexpected source warrants review.
• Security-tooling tamper attempts. Sality has a documented history of attempting to disable Windows Security Center, terminate AV/security processes, and block access to security-vendor domains via hosts-file or firewall manipulation. Alert on unexplained modification of the hosts file, unexpected outbound firewall rule changes, or termination of security-agent processes by non-administrative or unrecognized parent processes.
• Persistence via Run keys/services. Registry Run key additions or new service creation tied to unsigned or newly-dropped binaries on a workstation, particularly in combination with any of the above, should be correlated as a single incident rather than triaged independently.

Identity Layer

Sality is not primarily an identity-attack tool, so this layer is thinner than the other two — but two things are worth watching: any unexpected local administrative account creation or use on hosts that also show file-infection or injection indicators above (consistent with a broader compromise using Sality as one component), and unusual authentication from infected hosts if Sality's historical credential-theft/proxy capabilities are active on a given variant, since not all payloads Sality has delivered over its lifetime are network-visible in the same way.

Indicators of Compromise

Network

Note: CrowdStrike and DOJ have not, as of this post, published a detailed public IOC list of the specific super-peer IPs, sinkhole ranges, or seized domains involved in the August 31 operation. The table above reflects only from intel in our own OSINT feeds; it should not be treated as a complete indicator set for the broader takedown.

Hashes

No file hashes are currently available.

Host Artifacts

MITRE ATT&CK Mapping

Key Takeaways

A 23-year-old botnet is a reminder that "old" malware isn't dead malware. Sality predates most currently-employed SOC analysts' careers, and it was still distributing payloads to 15,000+ hosts in 2026. Longevity in this space usually means the architecture was resilient, not that defenders should deprioritize it.

Takedown is not remediation — again. As with C2 disruptions generally, sinkholing Sality's peer list and seizing its domains stops new tasking and payload delivery; it does not disinfect a single already-compromised host. Every organization with legacy Sality infections needs active hunting, not just a sigh of relief that "it got taken down."

The takedown technique itself is worth knowing. Peer-list poisoning is a recurring playbook against resilient P2P botnets (GameOver Zeus, Kelihos, now Sality). Understanding how it works is useful context for interpreting why previously-reliable C2 infrastructure for a tracked family might suddenly go dark — it may be law enforcement/industry action rather than the operator going quiet voluntarily.

This intel leans on secondary reporting, not primary DOJ/CrowdStrike IOC packages. The network indicators here come from our own intel OSINT feed, not a published CrowdStrike or Shadowserver indicator list.

References

1. The Hacker News. (2026, September 2). Authorities Turn Sality's P2P Network Against Itself, Cutting Off New Malware Payloads. https://thehackernews.com/2026/09/authorities-turn-salitys-p2p-network.html

2. SecurityWeek. (2026, September). 23-Year-Old Sality P2P Botnet Disrupted. https://www.securityweek.com/23-year-old-sality-p2p-botnet-disrupted/

3. CrowdStrike. (2026, September). Peer Pressure: Inside the Sality Botnet Disruption Operation. https://www.crowdstrike.com/en-us/blog/inside-sality-botnet-disruption-operation/

4. The Record. (2026, September). Sality, one of the longest-running botnets, finally gets disrupted. https://therecord.media/sality-botnet-cyber-doj

5. BleepingComputer. (2026, September). Sality botnet infrastructure dismantled in joint global takedown. https://www.bleepingcomputer.com/news/security/sality-botnet-infrastructure-dismantled-in-joint-global-takedown/

6. U.S. Attorney's Office, Central District of California / Department of Justice. (2026, August/September). Sality Malware Disrupted in International Cyber Takedown. https://www.justice.gov/usao-cdca/pr/sality-malware-disrupted-international-cyber-takedown

7. Help Net Security. (2026, September 2). Global sinkhole operation ends Sality botnet's 23-year run. https://www.helpnetsecurity.com/2026/09/02/sality-botnet-disruption-crowdstrike-law-enforcement/

8. The Register. (2026, September 2). Cops, CrowdStrike disrupt Sality botnet by poisoning the network and diverting into sinkholes. https://www.theregister.com/cyber-crime/2026/09/02/cops-crowdstrike-disrupt-sality-botnet-by-poisoning-the-network-and-diverting-into-sinkholes/5293795

9. CyberScoop. (2026, September). Dogged Russia-based botnet dismantled after 23-year run. https://cyberscoop.com/sality-botnet-dismantled/

10. Internal: 2026-09-02 Morning Threat Intelligence Brief (Daily Briefs folder) — source of the Sality-linked FQDN/URL IOC set used in this draft.