{"id":221893,"date":"2026-09-02T13:50:55","date_gmt":"2026-09-02T13:50:55","guid":{"rendered":"https:\/\/mycryptomania.com\/?p=221893"},"modified":"2026-09-02T13:50:55","modified_gmt":"2026-09-02T13:50:55","slug":"sality-takedown-isolates-15000-machines-used-in-crypto-theft","status":"publish","type":"post","link":"https:\/\/mycryptomania.com\/?p=221893","title":{"rendered":"Sality Takedown Isolates 15,000 Machines Used in Crypto Theft"},"content":{"rendered":"

CrowdStrike and the U.S. Department of Justice disrupted the Sality botnet, isolating more than 15,000 infected machines that had been used to distribute malicious payloads. Active since 2003, Sality spent the past eight years primarily delivering EggJagger, a tool that monitored copied cryptocurrency wallet addresses and replaced them with addresses controlled by its operator.<\/p>\n

The operation<\/a> targeted a damaging weakness in cryptocurrency payment workflows. When malware changes an address before a payment is completed, funds can be redirected to a different recipient. CrowdStrike estimates that EggJagger alone was responsible for at least 12.1 million rubles, or roughly $150,000, in stolen cryptocurrency.<\/p>\n

Today the @FBI<\/a>, @TheJusticeDept<\/a>, and the Defense Criminal Investigative Service (DCIS) announced a multinational operation with actions in the United States and Europe to disrupt the botnet known as Sality.<\/p>\n

Since 2003, the Sality botnet has installed malware on compromised\u2026 pic.twitter.com\/HNIY3oCGYr<\/a><\/p>\n

\u2014 FBI Cyber Division (@FBICyberDiv) September 1, 2026<\/a><\/p>\n\n

Sality was first observed in 2003 and evolved into a peer-to-peer botnet. Rather than relying on a central command-and-control server, infected machines communicated directly with one another. The malware also spreads by attaching itself to executable files shared through network shares, removable drives, and file sharing.<\/p>\n

According to CrowdStrike, Sality\u2019s technical role was to deploy additional payloads to infected machines. EggJagger became its primary payload over the past eight years.<\/p>\n

The clipjacking tool monitored a victim\u2019s clipboard for cryptocurrency<\/a> wallet addresses and silently replaced them with an address controlled by the operator. A person copying a Bitcoin or Ethereum address to make a payment could therefore have funds redirected away from the intended recipient.<\/p>\n

This mechanism differs from an exchange breach or a smart-contract exploit. It involved the device and clipboard used in the process of preparing a cryptocurrency payment, rather than an attack on the blockchain itself.<\/p>\n

Trade XRP on ByBit and Join 99Bitcoin\u2019s Exclusive $1000 USDT Airdrop Campaign<\/span><\/a><\/p>\n

What the Takedown Proves, and What It Does Not<\/h2>\n

CrowdStrike\u2019s Counter Adversary Operations team used Sality\u2019s peer-to-peer design against the botnet. The operation manipulated peer lists by removing legitimate peers and inserting CrowdStrike-controlled sinkholes. This isolated infected machines from the operator\u2019s control and prevented the botnet from receiving new tasking.<\/p>\n

The U.S. Department of Justice, FBI, and Defense Criminal Investigative Service took action against Sality-linked infrastructure in the United States. Law-enforcement partners in Bulgaria, Hungary, and Romania supported related action in Europe. The Shadowserver Foundation is working with internet providers to notify victims.<\/p>\n

Agents at the FBI\u2019s cyber division headquarters monitor global data streams in real-time.<\/p>\n

CrowdStrike tracks the operator as SALTY SPIDER. The firm said the stolen cryptocurrency was largely left unspent, with the portfolio reaching a peak value of about 147 million rubles in January 2025, nominally around $1.35 million.<\/p>\n

Disrupting the operator\u2019s control channel does not remove malware from compromised systems. CrowdStrike said that malware already present on infected machines remains active until it is removed, meaning affected systems still require remediation.<\/p>\n

EXPLORE:\u00a0Best Crypto Presales With Asymmetric Upside in the Current Market<\/a><\/strong><\/p>\n

Why the Theft Matters for Crypto Users<\/h2>\n

The confirmed EggJagger theft total is limited to one payload family, but the mechanism shows how malware can interfere with a routine payment workflow. A copied address can originate from a legitimate source, while the clipboard content is altered on an infected device before a transaction is completed.<\/p>\n

The more than 15,000 machines isolated during the operation illustrate the scale of the infrastructure CrowdStrike addressed. The case centers on clipboard substitution: malware monitored cryptocurrency wallet addresses and replaced them with addresses controlled by the operator, redirecting payments made from infected computers.<\/p>\n

Bitcoin and the Sality Disruption<\/h2>\n

Bitcoin\u2019s market context and the Sality operation are separate issues. The botnet used cryptocurrency addresses as part of its theft scheme, but the evidence surrounding the disruption does not establish a connection between the operation and Bitcoin\u2019s market direction.<\/p>\n

<\/span><\/p>\n

\n
\n
\n
\n
<\/div>\n
<\/div>\n<\/div>\n
\n
<\/div>\n
<\/div>\n<\/div>\n
\n
Market Cap<\/div>\n
<\/div>\n<\/div>\n<\/div>\n
\n
\n\t\t\t\t