Cops, CrowdStrike disrupt Sality botnet by poisoning the network and diverting into sinkholes

security Researcher shows how Claude Code can be tricked simply by asking it to summarize a website

Researcher shows how Claude Code can be tricked simply by asking it to summarize a website

virtualization Broadcom pledges to lock down open source Python, Java libraries

Broadcom pledges to lock down open source Python, Java libraries

science German-Japanese researchers invent electricity-free tech that could cool datacenters

German-Japanese researchers invent electricity-free tech that could cool datacenters

NETWORKS A lot of datacenter networks are run by absolute clowns. Not Amazon's

A lot of datacenter networks are run by absolute clowns. Not Amazon's

ai and ml OpenClaw 2.0 pours glitter on slow-burning security dumpster fire

OpenClaw 2.0 pours glitter on slow-burning security dumpster fire

International law enforcement agencies, working with CrowdStrike and Shadowserver Foundation, have disrupted Sality, a 23-year-old peer-to-peer botnet used to deliver malware to more than 15,000 machines worldwide.

The botnet has operated since 2003 and distributed all types of malicious code to victims, spanning credential theft, spam distribution, proxy services, network exploitation, and distributed denial-of-service (DDoS) attacks.

For the past eight years, Sality’s primary payload has been EggJagger, a tool that monitors clipboards for cryptocurrency wallet addresses, then silently replaces them with attacker-controlled addresses. When a victim copies a bitcoin or ethereum address to make a payment, the malware redirects funds into the criminals’ wallets.

CrowdStrike estimates Sality's operator stole at least $150,000 in cryptocurrency using EggJagger alone.

On Monday, CrowdStrike's Counter Adversary Operations team, working with international law enforcement agencies and industry partners, disrupted Sality by executing a peer-to-peer sinkhole operation.

This operation isolated infected machines, which broke the criminal operator’s ability to communicate with devices on its network. Once isolated, the bots can no longer receive payload download instructions or direct payload transfers, effectively breaking the botnet.

“In practice, the operation targeted the data structure at the heart of every bot's network awareness: its peer list,” CrowdStrike Counter Adversary Operations team said in a technical writeup the takedown.

Each Sality bot maintains a list of known super peers – publicly reachable infected machines that form the backbone of the P2P network. Every 40 minutes, the bots check to see if their peers are still online. Peers that fail to respond are purged from the network.

The counterattack took advantage of this by removing legitimate super peers in each bot’s peer list, continually isolating more infected machines in the network, and inserting purpose-built sinkhole entries into peer lists. That approach gave police and cyber operatives visibility into the operation’s progress and helped them notify victims.

In addition to the sinkhole operation, the US Justice Department, FBI, and Department of Defense Office of Inspector General’s Defense Criminal Investigative Service seized Sality-linked domains in the US. Meanwhile, international law enforcement in Bulgaria, Hungary, and Romania took action against additional Sality-linked domains hosted in Europe.

Meanwhile, the Shadowserver Foundation is working with internet service providers and Computer Security Incident Response Teams (CSIRTs) to identify infections and aid in victim notification and remediation.®

Cops, CrowdStrike disrupt Sality botnet by poisoning the network and diverting into sinkholes

23-year-old botnet down

Anthropic promises zero data retention – but customers must check it worked

More compliance-friendly stance could boost appeal of Fable

Platform Engineering 2.0: your platform was built for a different era. AI just exposed it

PARTNER CONTENT: Platform engineering won the argument. Now it has to grow up fast and evolve for the AI era.

Another Artifactory CVE under attack by AI agents or humans

Unauthenticated intruders can mint admin tokens, and exposed servers are already being hit

The teen Bill Gates has answers to the AI-pocalypse the 70-year-old Gates has forgotten

Hacking education to thrive in the AI world is the first and best step in keeping control

Attacker stole a METR API key, used $600K worth of credits, and no one noticed for weeks

The model provider gave METR the credits for free. An actual customer would not have been so lucky

security Researcher shows how Claude Code can be tricked simply by asking it to summarize a website

Researcher shows how Claude Code can be tricked simply by asking it to summarize a website

virtualization Broadcom pledges to lock down open source Python, Java libraries

Broadcom pledges to lock down open source Python, Java libraries

security Security vets rally around $4 paper password books for sale in Australia

Security vets rally around $4 paper password books for sale in Australia

science German-Japanese researchers invent electricity-free tech that could cool datacenters

German-Japanese researchers invent electricity-free tech that could cool datacenters

Legal Nuisance-call blocker fined £190k for being a nuisance caller

Nuisance-call blocker fined £190k for being a nuisance caller

AI and ml Apple defies memory shortage with new Mac minis

Apple defies memory shortage with new Mac minis

ai and ml Anthropic promises zero data retention – but customers must check it worked More compliance-friendly stance could boost appeal of Fable

Anthropic promises zero data retention – but customers must check it worked

More compliance-friendly stance could boost appeal of Fable

Security Attacker stole a METR API key, used $600K worth of credits, and no one noticed for weeks The model provider gave METR the credits for free. An actual customer would not have been so lucky

Attacker stole a METR API key, used $600K worth of credits, and no one noticed for weeks

The model provider gave METR the credits for free. An actual customer would not have been so lucky

ai and ml Anthropic pledges to try harder to keep models under control, asks partners to chip in Security ... this time it will be different

Anthropic pledges to try harder to keep models under control, asks partners to chip in

Security ... this time it will be different

SYSTEMS Nvidia is building an IP licensing empire on the back of NVLink Even when you think you're not buying Nvidia, you might still be buying Nvidia

Nvidia is building an IP licensing empire on the back of NVLink

Even when you think you're not buying Nvidia, you might still be buying Nvidia

ai and ml Energy biz SSE smacked around in court by a guy and AI Company's three year pursuit of debt from non-existent address ended by Oxford judge

Energy biz SSE smacked around in court by a guy and AI

Company's three year pursuit of debt from non-existent address ended by Oxford judge

Security Russians are posing as Signal support to launch phishing attacks PLUS: US takes down Iranian propaganda sites; Marketing company asks 'Why Do We Have Your Information?' And more!

Russians are posing as Signal support to launch phishing attacks

PLUS: US takes down Iranian propaganda sites; Marketing company asks 'Why Do We Have Your Information?' And more!

Security Microsoft patches failed to fix on-prem SharePoint, which is now under zero-day attack PLUS: China upgrades smartphone surveillance tools; Ring eases anti-snooping stance; and more

Microsoft patches failed to fix on-prem SharePoint, which is now under zero-day attack

PLUS: China upgrades smartphone surveillance tools; Ring eases anti-snooping stance; and more

Black Hat and DEF CON DEF CON Franklin project enlists hackers to harden critical infrastructure Voting village reports have been so successful, says Jeff Moss, that the whole of DEF CON will now be included

Black Hat and DEF CON

DEF CON Franklin project enlists hackers to harden critical infrastructure

Voting village reports have been so successful, says Jeff Moss, that the whole of DEF CON will now be included

Security EQT buys majority in Swiss cybersecurity biz Acronis Went at equivalent of $3.5B+ valuation for entire firm, though portion sold not specified

EQT buys majority in Swiss cybersecurity biz Acronis

Went at equivalent of $3.5B+ valuation for entire firm, though portion sold not specified

Malware Month Ten years since the first corp ransomware, Mikko Hyppönen sees no end in sight On the plus side, infosec's a good bet for a long, stable career

Ten years since the first corp ransomware, Mikko Hyppönen sees no end in sight

On the plus side, infosec's a good bet for a long, stable career

Debian votes to let contributors code with AI Disclosure optional, quality mandatory

Debian votes to let contributors code with AI

Disclosure optional, quality mandatory

LibreOffice 26.8 is out – local first, and with no AI It looks a bit clunky, but it does the job – and on your own computer

LibreOffice 26.8 is out – local first, and with no AI

It looks a bit clunky, but it does the job – and on your own computer

Keepers of Noble Numbats to be offered a Resolute Racoon: Ubuntu 26.04.1 is coming GRUB's up for furry new update

Keepers of Noble Numbats to be offered a Resolute Racoon: Ubuntu 26.04.1 is coming

GRUB's up for furry new update

AROS, the FOSS recreation of AmigaOS, comes to Raspberry Pi Plus: new official Amiga-branded hardware is coming

AROS, the FOSS recreation of AmigaOS, comes to Raspberry Pi

Plus: new official Amiga-branded hardware is coming

Emperor Penguin Linus Torvalds banishes a bug – with a bot The lad himself finds and fixes a tricky one… or does he?

Emperor Penguin Linus Torvalds banishes a bug – with a bot

The lad himself finds and fixes a tricky one… or does he?

FOSS smashed one Microsoft monopoly. After 20 years of failure, it's time to smash another Word up

FOSS smashed one Microsoft monopoly. After 20 years of failure, it's time to smash another