BleepingComputer reported on 2 September 2026 that international law enforcement agencies and private partners seized Sality malware infrastructure in a joint action to disrupt and take down the long-running peer-to-peer (P2P) botnet. With support from Europol and Eurojust, the U.S. Department of Justice, FBI and DCIS seized Sality-linked domains in the United States, while authorities in Bulgaria, Hungary and Romania seized additional Sality-linked domains hosted in Europe.

CrowdStrike's Counter Adversary Operations team, with law enforcement and industry partners, sinkholed Sality's list of known super peers, which form the botnet's communication backbone, to block file packs (direct payload transfers) and URL packs (payload download instructions) and purge infected machines' peer lists.

According to BleepingComputer, Sality has infected over 15,000 devices since at least 2003, and CrowdStrike says it is controlled by a criminal group it tracks as SALTY SPIDER, likely operating out of the Republic of Bashkortostan in Russia.

CrowdStrike says the two Sality networks still active at the takedown were mainly used to push EggJagger, a clipjacking tool that swaps cryptocurrency wallet addresses copied to the clipboard, and that Sality's history spans credential theft, spam, proxy services, network exploitation and DDoS payloads; it says the botnet 'is now no longer under the operator's control'. (source: BleepingComputer)

Correction (1 Nov 2026): removed the SecurityWeek link and credit, which this desk cannot read; the closing CrowdStrike line now quotes BleepingComputer's text ('no longer under the operator's control') instead of the earlier paraphrase. The card date stays 2 September 2026, BleepingComputer's date (4:00 am US Eastern, 4:00 pm Perth).