DOJ and International Partners Disrupt Long-Running Sality Botnet

The U.S. Department of Justice, FBI, and international partners teamed up with CrowdStrike and the Shadowserver Foundation to execute a sinkhole operation dismantling the Sality botnet.

The Department of Justice today announced a coordinated multinational operation spanning the United States, Bulgaria, Hungary, and Romania, conducted in partnership with private sector leaders CrowdStrike and the Shadowserver Foundation, to disrupt the peer-to-peer botnet and malware family known as Sality.

Coordination between government agencies and private industry was central to the operation, aligning with the core objective of degrading adversary tools and malicious infrastructure. Federal law enforcement collaborated closely with industry analysts to identify compromised networks, seize infrastructure, and limit ongoing exploitation.

“Cybercriminals, botnets, and malware are a clear and present danger to our nation’s security and economy,” said First Assistant United States Attorney Bill Essayli. “This successful effort to take down the Sality botnet shows that by working together the public and private sectors can be a powerful force for good.”

“This unique collaboration among international law enforcement and private sector partners only enhances the FBI’s cyber security capabilities and our efforts to neutralize the threat posed by the Sality botnet,” said Patrick Grandy, Assistant Director in Charge of the FBI’s Los Angeles Field Office. “The FBI will continue working with our partners to prevent further cyber-enabled attacks and theft from victims in the United States.”

“Protecting the integrity of the Department of Defense Information Network from clear threats like the Sality botnet is a top priority for us,” said Special Agent in Charge Kenneth DeChellis of the Department of Defense Office of Inspector General’s Defense Criminal Investigative Service (DCIS), Cyber Field Office. “Today’s announcement is the result of the shared commitment and long-standing partnership between international law enforcement and the private sector.”

Active since 2003, Sality functioned as a decentralized peer-to-peer (P2P) botnet, distributing malware across compromised host computers to facilitate cyberattacks and cryptocurrency theft worldwide. Because P2P nodes commands directly among infected machines rather than relying on a centralized command server, dismantling the network required a complex technical takedown.

CrowdStrike’s Counter Adversary Operations team, working alongside the DOJ, FBI, DCIS, and foreign law enforcement partners, executed an extensive P2P sinkhole operation to redirect malicious bot traffic away from criminal operators.

As part of the joint action: • U.S. authorities seized multiple Sality-controlled web domains hosted domestically. • Foreign law enforcement counterparts in Bulgaria, Hungary, and Romania targeted and seized European infrastructure tied to the botnet. • The Shadowserver Foundation is collaborating with internet service providers (ISPs) and Computer Security Incident Response Teams (CSIRTs) to identify infected devices, issue notifications, and assist affected victims with remediation.

Substantial investigative and operational support was provided by Bulgaria’s General Directorate Combating Organized Crime, Hungary’s National Bureau of Investigation Cybercrime Department, Romania’s Central Cybercrime Unit within the Directorate for Combating Organized Crime, alongside Eurojust, Europol, and the DOJ’s Office of International Affairs.

The U.S. phase of the operation was led by Assistant United States Attorney Lauren Restrepo of the National Security Division, in coordination with the FBI’s Los Angeles Field Office and DCIS.