Russian Cybercrime Operation Being Dismantled After Two Decades, US Officials and CrowdStrike Say
CrowdStrike said the peer-to-peer malware had infected more than 15,000 machines worldwide and stolen at least $150,000 in cryptocurrency.
- On Tuesday, U.S. law enforcement officials and CrowdStrike announced the dismantling of Sality, a 23-year-old Russian hacking operation that utilized a peer-to-peer botnet to deliver malware and steal cryptocurrency worldwide.
- First spotted in 2003, Sality operated as a resilient peer-to-peer network for over two decades, infecting more than 15,000 machines to facilitate spam, DDoS attacks, and cryptocurrency theft via the EggJagger tool.
- CrowdStrike and international law enforcement disrupted the botnet on Monday by executing a peer-to-peer sinkhole operation, seeding the network with bogus data that tricked compromised machines into severing connections from their creator.
- The U.S. Justice Department, FBI, and European law enforcement partners seized Sality-linked web domains, while the Shadowserver Foundation works with Computer Security Incident Response Teams to aid victim notification and remediation.
- While the takedown isolated infected machines, cybersecurity experts warn the unidentified creator could attempt to rebuild the botnet, emphasizing that Sality remains a dangerous vector for future cyber-enabled attacks.
64 Articles
64 Articles
23-Year-Old Noboru Botnet Dismantled in Global Law Enforcement Operation
A 23-year-old botnet called “Noboru,” which compromised over 15,000 computers worldwide using modular, peer-to-peer malware, was dismantled through coordinated international law enforcement and CrowdStrike researchers. The operation ended one of the longest-running cybercrime infrastructures ever discovered.
US Authorities, CrowdStrike Disrupt Sality Botnet Used to Steal at Least $150,000 in Crypto
The US Justice Department said an international operation involving European law enforcement and private-sector partners disrupted Sality's operations, cutting the malware network off from its operator. Sality had been linked to cryptocurrency theft and other cyberattacks.Visit Website
Cointelegraph
The New York LedgerUS Officials Work with CrowdStrike to Fight Malware behind Crypto Theft
The operators behind the Sality botnet and malware used a “clipjacking tool“ to replace wallet addresses with ones they controlled, enabling the theft of thousands of dollars in crypto.
CyberScoopcybernoz.comDogged Russia-based botnet dismantled after 23-year run
Sality’s peer-to-peer infrastructure allowed it to evade system-wide disruption efforts for an exceptionally long period. Authorities and cybersecurity experts finally brought it down.
Coverage Details
Bias Distribution
- 85% of the sources are Center
Factuality
To view factuality data please Upgrade to Premium
