Sality Botnet Dismantled After Decades of Cryptocurrency Theft

CrowdStrike and the Department of Justice have dismantled the Sality botnet, a malicious network that operated for over eight years. Since its inception in 2003, Sality intercepted cryptocurrency payments by manipulating wallet addresses on infected computers.

The central mechanism of the theft was EggJagger, a tool that monitored the clipboard of each compromised machine and replaced copied Bitcoin or Ethereum addresses with those controlled by the attacker.

CrowdStrike estimates that through EggJagger alone, the perpetrator accumulated at least 12.1 million rubles, equivalent to approximately $150,000. However, the stolen coins were largely untouched, reaching an estimated peak of 147 million rubles in January 2025, or around $1.35 million.

The botnet's decentralized architecture, which allowed infected machines to communicate directly with each other and spread through executable files shared across local networks and removable drives, proved to be its weak point.