[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"branding":3,"analytics":7,"article-crowdstrike-and-feds-disrupt-sality-a-botnet-older-than-the-iphone":10,"sections":41},{"siteName":4,"siteTagline":5,"publisherName":4,"contactEmail":6},"The Revision","Tech news, decoded.","editor@therevision.news",{"gaMeasurementId":8,"adsenseClientId":9},"G-ZW2MV82GYR","ca-pub-8533917693782264",{"article":11},{"id":12,"slug":13,"title":14,"dek":15,"body_md":16,"tags_json":17,"published_at":18,"created_at":19,"updated_at":20,"status":21,"review_note":22,"review_notes":23,"image_url":22,"persona_id":22,"persona_name":22,"section":30,"tags":31,"sources":36,"feedback":40,"feedback_at":22,"cost_usd":40,"total_tokens":40},5992,"crowdstrike-and-feds-disrupt-sality-a-botnet-older-than-the-iphone","CrowdStrike and Feds Disrupt Sality, a Botnet Older Than the iPhone","A 23 year old peer-to-peer botnet used lately to hijack crypto payments has been sinkholed by CrowdStrike and international law enforcement.","A botnet that predates the iPhone by four years just got sinkholed.\n\nCrowdStrike, working with the DOJ, FBI, DCIS, Europol, Eurojust, and law enforcement in Bulgaria, Hungary, and Romania, disrupted Sality, a peer-to-peer botnet running since 2003. Unlike botnets that phone home to one server, Sality's roughly 15,000 infected endpoints talked to each other, which is why it survived this long. Since 2018, its main job has been spreading EggJagger, a clipboard hijacker that swaps copied crypto wallet addresses for the attacker's own. CrowdStrike says that trick alone netted its operators more than $150,000.\n\nThe takedown method matters as much as the target. Instead of seizing servers, researchers planted their own devices inside the botnet's peer network and used them to purge other nodes' peer lists, cutting off communication from the inside. They paired that with getting the URLs hosting Sality's malware payloads pulled, so infected machines can't fetch new instructions during the transition.\n\nA 23-year survival streak is the real story here. Sality outlasted most of the malware families it once helped distribute, largely because decentralized architecture makes botnets annoying to kill piece by piece. CrowdStrike is careful to call this a disruption, not an eradication - sinkholing blinds infected machines rather than removing the infection, so any surviving endpoints with cached payload URLs could still cause trouble until cleanup finishes.","[\"botnet\",\"crowdstrike\",\"cybercrime\",\"cryptocurrency\"]","2026-09-02T14:25:00.000Z","2026-09-02T14:47:18.584Z","2026-09-02T14:47:30.540Z","published",null,[24],{"id":25,"reviewer":26,"round":27,"reason":28,"status":29},"editor-r1","editor",1,"Headline claims the botnet was 'Finally Dismantled,' but the source and the article's own closing line describe a sinkholing\u002Fdisruption operation that explicitly does not guarantee permanent removal — rewrite the headline\u002Fdek to say 'disrupted' or 'sinkholed' so it doesn't overstate an outcome the body itself undercuts.","resolved","security",[32,33,34,35],"botnet","crowdstrike","cybercrime","cryptocurrency",[37],{"name":38,"url":39},"TechRadar","https:\u002F\u002Fwww.techradar.com\u002Fpro\u002Fsecurity\u002Fa-botnet-running-for-23-years-with-over-15-000-endpoints-has-finally-been-shut-down-by-law-enforcement-and-crowdstrike",0,{"sections":42},[43,48,52,57,62,67,72,77,82,87,92,97,102,107],{"name":44,"slug":45,"count":46,"latest_published_at":47},"AI","ai",3385,"2026-09-04T22:17:36.000Z",{"name":49,"slug":30,"count":50,"latest_published_at":51},"Security",565,"2026-09-05T00:03:08.000Z",{"name":53,"slug":54,"count":55,"latest_published_at":56},"Policy","policy",300,"2026-09-04T22:18:34.000Z",{"name":58,"slug":59,"count":60,"latest_published_at":61},"Deals","deals",179,"2026-06-29T20:02:07.000Z",{"name":63,"slug":64,"count":65,"latest_published_at":66},"Hardware","hardware",152,"2026-09-03T09:26:48.000Z",{"name":68,"slug":69,"count":70,"latest_published_at":71},"Consumer Tech","consumer-tech",97,"2026-09-04T15:29:18.000Z",{"name":73,"slug":74,"count":75,"latest_published_at":76},"Science","science",96,"2026-09-03T22:30:00.000Z",{"name":78,"slug":79,"count":80,"latest_published_at":81},"Software","software",73,"2026-08-18T07:51:50.000Z",{"name":83,"slug":84,"count":85,"latest_published_at":86},"Dev Tools","dev-tools",69,"2026-08-18T04:00:00.000Z",{"name":88,"slug":89,"count":90,"latest_published_at":91},"Startups","startups",54,"2026-09-04T23:36:14.000Z",{"name":93,"slug":94,"count":95,"latest_published_at":96},"Gaming","gaming",41,"2026-07-09T04:00:00.000Z",{"name":98,"slug":99,"count":100,"latest_published_at":101},"General","general",37,"2026-09-04T20:22:41.000Z",{"name":103,"slug":104,"count":105,"latest_published_at":106},"Reviews","reviews",20,"2026-06-24T12:00:01.000Z",{"name":108,"slug":109,"count":110,"latest_published_at":111},"How-To","how-to",6,"2026-06-16T09:00:00.000Z"]