SALTY SPIDER - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/actors/salty-spider/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 02 Sep 2026 11:59:42 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgDisruption of the Sality Peer-to-Peer Botnethttps://feed.craftedsignal.io/briefs/2026-09-sality-disruption/Wed, 02 Sep 2026 11:59:42 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-09-sality-disruption/CrowdStrike and international law enforcement neutralized the long-running Sality P2P botnet, which leveraged polymorphic file infection and decentralized C2 to distribute malicious payloads to over 15,000 infected machines.On August 31, 2026, CrowdStrike's Counter Adversary Operations team, in coordination with the FBI, DOJ, DCIS, and international law enforcement agencies, executed a successful sinkholing operation against the Sality P2P botnet. Active since 2003, Sality functioned as a highly resilient, polymorphic file-infecting malware that operated without centralized command-and-control infrastructure. By leveraging a decentralized peer-to-peer architecture, infected hosts communicated directly with one another to receive tasking and updates. The botnet utilized two distinct, incompatible protocol versions (v3 and v4) that shared a common codebase but used unique cryptographic keys. The operation successfully isolated infected machines by subverting the P2P communication channel, rendering the botnet infrastructure inert and cutting off access for approximately 15,000 active nodes globally.

Attack Chain

  1. Initial infection typically occurs via polymorphic file infection of local executable files or propagation through unprotected network shares.
  2. Malware establishes persistence on the host, often injecting code into legitimate processes to evade detection.
  3. The infected host performs a peer discovery process to identify other active Sality nodes in the P2P network.
  4. The host attempts to reach out to pre-configured URL packs to download malicious updates, configuration changes, or secondary payloads.
  5. The botnet client verifies payload signatures using hardcoded RSA public keys embedded within the malware binary.
  6. The malware executes functional modules (e.g., clipjacking for credential or cryptocurrency theft, proxying, or DDoS tasking).
  7. The compromised host continues to spread the infection to other systems via network shares or removable media until isolated by security controls.

Impact

Sality operated for over two decades, infecting thousands of systems worldwide and maintaining a robust infrastructure capable of delivering various malicious payloads. The botnet's capabilities included credential theft, cryptocurrency transaction hijacking, and DDoS participation. The disruption rendered these capabilities inert for 15,000 active infections at the time of the operation.

Recommendation

  1. Deploy the YARA rules provided in this brief to scan memory on enterprise endpoints for active Sality v3 and v4 infections.
  2. Block outbound traffic to the known malicious URL packs associated with Sality v3 and v4 at the network perimeter.
  3. Scan internal network shares for infected executables that may attempt to re-propagate the Sality file-infector.
  4. Review endpoint logs for unexpected execution of processes that attempt to verify signatures using the known RSA public keys embedded in Sality binaries.
]]>highthreatbotnetp2pmalwarefile-infectioncounter-adversary-operations