U.S. DOJ-led Sality botnet takedown
Law Enforcement
Summary
Hide ▲
Show ▼
U.S.-led law enforcement disrupted the Sality P2P botnet on August 31 with authorities from Bulgaria, Hungary, Romania, and the US, supported by Europol, CrowdStrike, and the Shadowserver Foundation. The operation used sinkholing and domain seizures to redirect traffic away from botnet infrastructure and isolate infected machines from operator control. Europol said Sality has operated for more than 20 years, and CrowdStrike said it has infected over 15,000 devices. The action also blocked further payload delivery through the peer network and targeted a botnet that had been used for credential theft, spam, proxying, network exploitation, DDoS, and crypto-theft.
Related Happenings
Sality botnet payload distribution and propagation activity
Malware Activity
H score62
First: 02.09.2026 09:56
Last: 02.09.2026 09:56
Sources 1
How related:
According to CrowdStrike, the botnet is said to have allowed the operator to distribute malicious payloads to more than 15,000 infected machines worldwide, adding that two independent P2P networks, known as version 3 and version 4, remained active until the disruption occurred.
About this happening:
The Sality P2P botnet has operated for more than 20 years and was disrupted in a US-led operation on August 31 with support from Bulgaria, Hungary, Romania, Euro...
Sality botnet payload distribution and propagation activity
Malware ActivityHow related: According to CrowdStrike, the botnet is said to have allowed the operator to distribute malicious payloads to more than 15,000 infected machines worldwide, adding that two independent P2P networks, known as version 3 and version 4, remained active until the disruption occurred.
About this happening: The Sality P2P botnet has operated for more than 20 years and was disrupted in a US-led operation on August 31 with support from Bulgaria, Hungary, Romania, Euro...
FBI seizure of NetNut proxy domains
Law Enforcement
H score33
First: 03.07.2026 12:35
Last: 03.07.2026 12:35
Sources 1
About this happening:
The FBI seized NetNut domains in a law-enforcement takedown of proxy infrastructure abused for cybercrime, disrupting a network that routed malicious traffic through r...
FBI seizure of NetNut proxy domains
Law EnforcementAbout this happening: The FBI seized NetNut domains in a law-enforcement takedown of proxy infrastructure abused for cybercrime, disrupting a network that routed malicious traffic through r...
StealC and Amadey infostealer infrastructure disruption
Malware Activity
H score69
First: 24.06.2026 18:25
Last: 24.06.2026 18:25
Sources 1
About this happening:
StealC and Amadey malware infrastructure was disrupted in Operation Endgame, cutting off the command-and-control services used to manage infected systems. Europol said...
StealC and Amadey infostealer infrastructure disruption
Malware ActivityAbout this happening: StealC and Amadey malware infrastructure was disrupted in Operation Endgame, cutting off the command-and-control services used to manage infected systems. Europol said...
Foreign-run botnets relaying traffic through infected Canadian devices
Malware Activity
H score22
First: 22.06.2026 12:11
Last: 22.06.2026 12:11
Sources 1
About this happening:
The public ruling confirms two foreign-run botnets used infected Canadian devices as traffic relays, a setup that can conceal probing of critical infrastructure, governm...
Foreign-run botnets relaying traffic through infected Canadian devices
Malware ActivityAbout this happening: The public ruling confirms two foreign-run botnets used infected Canadian devices as traffic relays, a setup that can conceal probing of critical infrastructure, governm...
Operation Endgame international cybercrime disruption initiative
Public Sector Action
H score57
First: 19.06.2026 18:07
Last: 19.06.2026 18:07
Sources 1
About this happening:
Operation Endgame is an ongoing international law enforcement initiative that now includes the takedown of SocGholish infrastructure, expanding disruption of botnets a...
Operation Endgame international cybercrime disruption initiative
Public Sector ActionAbout this happening: Operation Endgame is an ongoing international law enforcement initiative that now includes the takedown of SocGholish infrastructure, expanding disruption of botnets a...
Timeline
-
02.09.2026 09:56 4 articles · 13d ago
Authorities sinkhole the Sality P2P botnet and seize linked domains
Legal Policy Action UpdateOn August 31, 2026, authorities from the United States, Bulgaria, Hungary, and Romania, working with CrowdStrike and the Shadowserver Foundation, carried out a peer-to-peer sinkhole operation against the Sality botnet and seized Sality-linked domains in the U.S. and Europe. The action disrupted the botnet's P2P architecture, isolated peers from threat-actor control, and contributed to blocking further payload delivery to infected machines worldwide.
Show sources
- Authorities Turn Sality's P2P Network Against Itself, Cutting Off New Malware Payloads — thehackernews.com — 02.09.2026 09:56
- Authorities Turn Sality's P2P Network Against Itself, Cutting Off New Malware Payloads — thehackernews.com — 02.09.2026 09:56
- Sality botnet infrastructure dismantled in joint global takedown — www.bleepingcomputer.com — 02.09.2026 11:00
- International Operation Disrupts Sality P2P Botnet — www.infosecurity-magazine.com — 03.09.2026 11:30
-
02.09.2026 09:56 1 articles · 13d ago
U.S. Department of Justice announces coordinated Sality botnet takedown
Initial DisclosureThe U.S. Department of Justice publicly announced the coordinated takedown of the Sality P2P botnet on Tuesday, describing a law-enforcement operation with CrowdStrike, the Shadowserver Foundation, and authorities from the United States, Bulgaria, Hungary, and Romania. The announcement said the effort used peer-to-peer sinkholing and domain seizures to neutralize Sality's control path and stop new payloads from reaching infected machines.
Show sources
- Authorities Turn Sality's P2P Network Against Itself, Cutting Off New Malware Payloads — thehackernews.com — 02.09.2026 09:56