Sality botnet disruption leaves address-swapping malware active

The disruption of the Sality botnet on Aug. 31 cut off its operator's ability to deliver new malware, but existing malware remains active on infected devices, according to a report by CrowdStrike. Users of these machines must remove the installed malware, which includes a tool that swaps cryptocurrency addresses, potentially redirecting payments. The botnet affected over 33000 compromised machines globally, though the number of users who lost cryptocurrency is unspecified. The Justice Department announced a multinational operation on Sept. 1, 2026, following the seizure of Sality-linked domains by U.S. authorities and actions taken by partners in Bulgaria, Hungary, and Romania. CrowdStrike identified EggJagger as the primary payload of Sality, which monitors the clipboard for cryptocurrency addresses and substitutes them with addresses controlled by the operator. This allows users to unintentionally send funds to the wrong destination. The malware can continue to operate even after Sality's communications are disrupted, necessitating removal by users with confirmed infections. CrowdStrike describes Sality as a file infector that spreads through executable files and network shares. The disruption altered communication among infected machines, isolating them from the operator. CrowdStrike recommends network operators check logs for UDP traffic to the address 188.166.101[.]148, which indicates a Sality infection. The Justice Department stated that the Shadowserver Foundation is collaborating with internet service providers to identify infections and assist affected users.