Destruction of Sality Botnet: A Major Cybersecurity Milestone

• •Sality botnet, active since 2003, was dismantled in a multinational operation.
• •Over 11 million unique IP addresses were linked to Sality's malware infrastructure.
• •The operation involved collaboration between law enforcement and private cybersecurity firms.

On August 31, 2026, an international operation led by the FBI dismantled the Sality botnet, active for over 20 years. Romania, along with the U.S., Bulgaria, and Hungary, played a crucial role in this operation. Sality was responsible for infecting millions of computers worldwide, with over 11 million unique IP addresses linked to its infrastructure. The botnet was utilized for various cybercrimes, including cryptocurrency theft and spam distribution. Authorities confiscated domains and servers associated with Sality in the U.S. and Europe. The operation involved collaboration with private cybersecurity firms like CrowdStrike and Shadowserver Foundation. Sality's decentralized nature made it difficult to neutralize, but investigators successfully disrupted its command and control mechanisms. This operation highlights the importance of international cooperation in combating long-standing cyber threats.