Sality botnet payload distribution and propagation activity
Malware Activity
Summary
Hide ▲
Show ▼
The Sality P2P botnet has operated for more than 20 years and was disrupted in a US-led operation on August 31 with support from Bulgaria, Hungary, Romania, Europol, CrowdStrike, and the Shadowserver Foundation. The action used sinkholing and seizures of Sality-linked domains to cut off the botnet’s control infrastructure. CrowdStrike said Sality enabled payload delivery to over 15,000 infected machines, while Europol said it had reached over one million infected machines at its peak and linked more than 11 million unique IP addresses over two decades. The activity supported credential theft, spam distribution, proxy services, network exploitation, DDoS attacks, and crypto-theft.
Related Happenings
BambooToken malware uses MQTT C2 on Windows and Linux systems
Malware Activity
H score31
First: 15.09.2026 18:00
Last: 15.09.2026 18:00
Sources 1
About this happening:
BambooToken is a multi-platform malware campaign using MQTT for command-and-control on Windows and Linux systems. Lumen Black Lotus Labs says the activity has...
BambooToken malware uses MQTT C2 on Windows and Linux systems
Malware ActivityAbout this happening: BambooToken is a multi-platform malware campaign using MQTT for command-and-control on Windows and Linux systems. Lumen Black Lotus Labs says the activity has...
U.S. DOJ-led Sality botnet takedown
Law Enforcement
H score75
First: 02.09.2026 09:56
Last: 02.09.2026 09:56
Sources 1
How related:
International law enforcement agencies and private partners have seized Sality malware infrastructure in a joint action aiming to disrupt and take down the peer-to-peer (P2P) botnet.
About this happening:
U.S.-led law enforcement disrupted the Sality P2P botnet on August 31 with authorities from Bulgaria, Hungary, Romania, and the US, supported by Europol, Cro...
U.S. DOJ-led Sality botnet takedown
Law EnforcementHow related: International law enforcement agencies and private partners have seized Sality malware infrastructure in a joint action aiming to disrupt and take down the peer-to-peer (P2P) botnet.
About this happening: U.S.-led law enforcement disrupted the Sality P2P botnet on August 31 with authorities from Bulgaria, Hungary, Romania, and the US, supported by Europol, Cro...
Millenium RAT Windows malware activity and native C++ rewrite
Malware Activity
H score62
First: 29.06.2026 17:30
Last: 29.06.2026 17:30
Sources 1
About this happening:
The Millenium RAT malware activity is spreading across Windows systems, with 60,000+ infections in 160+ countries and a newer native C++ build that helps it ev...
Millenium RAT Windows malware activity and native C++ rewrite
Malware ActivityAbout this happening: The Millenium RAT malware activity is spreading across Windows systems, with 60,000+ infections in 160+ countries and a newer native C++ build that helps it ev...
Foreign-run botnets relaying traffic through infected Canadian devices
Malware Activity
H score22
First: 22.06.2026 12:11
Last: 22.06.2026 12:11
Sources 1
About this happening:
The public ruling confirms two foreign-run botnets used infected Canadian devices as traffic relays, a setup that can conceal probing of critical infrastructure, governm...
Foreign-run botnets relaying traffic through infected Canadian devices
Malware ActivityAbout this happening: The public ruling confirms two foreign-run botnets used infected Canadian devices as traffic relays, a setup that can conceal probing of critical infrastructure, governm...
Operation Endgame international cybercrime disruption initiative
Public Sector Action
H score57
First: 19.06.2026 18:07
Last: 19.06.2026 18:07
Sources 1
About this happening:
Operation Endgame is an ongoing international law enforcement initiative that now includes the takedown of SocGholish infrastructure, expanding disruption of botnets a...
Operation Endgame international cybercrime disruption initiative
Public Sector ActionAbout this happening: Operation Endgame is an ongoing international law enforcement initiative that now includes the takedown of SocGholish infrastructure, expanding disruption of botnets a...
Timeline
-
02.09.2026 09:56 1 articles · 13d ago
U.S. and partner authorities sinkhole the Sality botnet and seize linked domains
Legal Policy Action UpdateAuthorities from the U.S., Bulgaria, Hungary, and Romania, working with CrowdStrike and the Shadowserver Foundation, used peer-to-peer sinkholing to disrupt the Sality P2P botnet and seized Sality-linked domains in the U.S. and Europe, cutting off the botnet's control infrastructure.
Show sources
- Authorities Turn Sality's P2P Network Against Itself, Cutting Off New Malware Payloads — thehackernews.com — 02.09.2026 09:56
-
02.09.2026 09:56 4 articles · 13d ago
CrowdStrike says Sality reached more than 15,000 infected machines
Campaign Scope UpdateCrowdStrike said the Sality botnet allowed operators to distribute malicious payloads to more than 15,000 infected machines worldwide, and that its version 3 and version 4 peer-to-peer networks remained active until the disruption.
Show sources
- Authorities Turn Sality's P2P Network Against Itself, Cutting Off New Malware Payloads — thehackernews.com — 02.09.2026 09:56
- Authorities Turn Sality's P2P Network Against Itself, Cutting Off New Malware Payloads — thehackernews.com — 02.09.2026 09:56
- Sality botnet infrastructure dismantled in joint global takedown — www.bleepingcomputer.com — 02.09.2026 11:00
- International Operation Disrupts Sality P2P Botnet — www.infosecurity-magazine.com — 03.09.2026 11:30