Cops, CrowdStrike disrupt Sality botnet by poisoning the network and diverting into sinkholes

{
  "signal_id": "261333e4-4e53-b2c9-2ecb-e937c10d0900",
  "signal_type": "news",
  "signal_subtype": "partners_with",
  "detected_at": "2026-09-01T23:54:07+00:00",
  "company": {
    "name": "CrowdStrike",
    "domain": "crowdstrike.com"
  },
  "data": {
    "url": "https://www.theregister.com/cyber-crime/2026/09/02/cops-crowdstrike-disrupt-sality-botnet-by-poisoning-the-network-and-diverting-into-sinkholes/5293795",
    "title": "Cops, CrowdStrike disrupt Sality botnet by poisoning the network and diverting into sinkholes",
    "excerpt": "cyber-crime 23-year-old botnet down International law enforcement agencies, working with CrowdStrike and Shadowserver Foundation, have disrupted Sality, a 23-year-old peer-to-peer botnet used to deliver malware to more than 15,000 machines worldwide. The botnet has operated since 2003 and distributed all types of malicious code to victims, spanning credential theft, spam distribution, proxy services, network exploitation, and distributed denial-of-service (DDoS) attacks. For the past eight years, Sality’s primary payload has been EggJagger, a tool that monitors clipboards for cryptocurrency wallet addresses, then silently replaces them with attacker-controlled addresses. When a victim copies a bitcoin or ethereum address to make a payment, the malware redirects funds into the criminals’ wallets. CrowdStrike estimates Sality's operator stole at least $150,000 in cryptocurrency using EggJagger alone. On Monday, CrowdStrike's Counter Adversary Operations team, working with international law enforcement agencies and industry partners, disrupted Sality by executing a peer-to-peer sinkhole operation. This operation isolated infected machines, which broke the criminal operator’s ability to communicate with devices on its network. Once isolated, the bots can no longer receive payload download instructions or direct payload transfers, effectively breaking the botnet. “In practice, the...",
    "summary": "CrowdStrike and the Shadowserver Foundation collaborated with international law enforcement agencies to disrupt the 23-year-old Sality peer-to-peer botnet.",
    "planning": false,
    "image_url": "https://image.theregister.com/247072.jpg?imageId=247072&x=0&y=0&cropw=100&croph=100&panox=0&panoy=0&panow=100&panoh=100&width=1200&height=683",
    "confidence": 0.9,
    "published_at": "2026-09-01T23:54:07Z",
    "effective_date": "2026-08-31",
    "article_sentence": "International law enforcement agencies, working with CrowdStrike and Shadowserver Foundation, have disrupted Sality, a 23-year-old peer-to-peer botnet used to deliver malware to more than 15,000 machines worldwide.",
    "related_company_name": "Shadowserver Foundation",
    "related_company_domain": "shadowserver.org"
  }
}

curl https://signals.autobound.ai/v1/signals/261333e4-4e53-b2c9-2ecb-e937c10d0900 \
  -H "X-API-KEY: $AUTOBOUND_API_KEY"

curl -X POST https://signals.autobound.ai/v1/companies/enrich \
  -H "X-API-KEY: $AUTOBOUND_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"domain":"crowdstrike.com","limit":20}'