US, CrowdStrike Dismantle Decades-Old Russian Cybercrime Operation - Global Banking & Finance Review

LAS VEGAS, Sept 1 (Reuters) - A two-decade-old Russian hacking operation dubbed "Sality" is being dismantled, U.S. law enforcement officials and cybersecurity company CrowdStrike announced on Tuesday.

U.S. officials said they had seized the web domains hackers used to take over computers to send spam, carry out distributed denial-of-service operations or steal cryptocurrency, while CrowdStrike said it had cut off a network of compromised computers from the mastermind controlling it.

Live Dismantling and Law Enforcement Coordination

CrowdStrike began dismantling the "botnet" on Monday in front of a live audience at the company’s Day Zero threat intelligence summit in Las Vegas.

The FBI and U.S. Justice Department said in a pair of statements issued on Tuesday that the operation had been carried out in coordination with European law enforcement and other organizations.

Official Statements and Significance

"Cybercriminals, botnets, and malware are a clear and present danger to our nation’s security and economy,” First Assistant United States Attorney Bill Essayli said in a statement announcing the move.

History and Resilience of Sality

Although it has in recent years been overshadowed by more disruptive ransom-seeking cybercriminals, Sality, first spotted in 2003, remains one of the internet’s longest-running cybercriminal enterprises.

The Justice Department said it was based out of Russia but did not provide further detail. The Russian Embassy in Washington did not immediately respond to a request for .

Technical Architecture and Challenges

Sality's peer-to-peer architecture meant it could receive commands through a diffuse network of compromised machines, making it particularly resistant to law enforcement action.

But CrowdStrike said in a blog post published on Tuesday that it turned that strength against Sality by seeding the network with bogus information that tricked the botnet's components into cutting themselves off from their creator.

CrowdStrike researcher Tillmann Werner said that reverse-engineering the botnet's structure, finding weak points and building the infrastructure needed to knock it down had required painstaking work.

"This was the most complex botnet takeover we have ever done," Werner told Reuters. "This was built to be resilient. It was built to survive takedown or takeover. I think that's the reason it's been around for so long."

Ongoing Risks and Future Outlook

David Watson, director of nonprofit security group The Shadowserver Foundation, which was also involved in the takedown, said Sality was "quite old-school" but could still be dangerous.

“It's still a vector into a lot of organizations,” Watson said.

He said the step would be to see what, if anything, Sality's creator, who has yet to be publicly identified, did to regain control of or re-create the botnet.

“What does he do?” Watson said. “Does he fight back?”

(Reporting by Raphael Satter in Las Vegas; Additional reporting by Anton Zverev in London; Editing by Jamie Freed)

Sal ity botnet—one of the longest‑running P2P cybercriminal networks—is being dismantled after nearly 20 years by U.S. authorities alongside CrowdStrike and European partners.

The disruption involved domain seizures by the FBI and DOJ, and a novel CrowdStrike engineering approach to trick botnet components into isolating themselves from their controller.

This operation builds on past U.S. cyber‑law enforcement successes against malware and botnets like Coreflood, ZeroAccess, Qakbot, and Volt Typhoon, underscoring evolving strategies amid rising cyber threats.

Frequently Asked Questions

Malta court clears businessman over murder of journalist Daphne Caruana Galizia

Shell to acquire stake in BP-operated Conifer prospect in Gulf of Mexico

DIW raises German economic growth forecasts as exports beat expectations

Trump says renewed US campaign against Iran won't last long

The killing of Maltese journalist Daphne Caruana Galizia and its aftermath

EasyJet, Ithaca Energy to join FTSE 100 index

Explore more articles in the Finance category