US Authorities, CrowdStrike Disrupt Sality Botnet Used to Steal at Least $150,000 in Crypto

The US Justice Department said an international operation involving European law enforcement and private-sector partners disrupted Sality’s operations, cutting the malware network off from its operator. Sality had been linked to cryptocurrency theft and other cyberattacks.

The Justice Department said Tuesday that authorities in Bulgaria, Hungary and Romania participated in the effort alongside CrowdStrike and the Shadowserver Foundation. According to US officials, the malware network had been infecting devices and deploying malicious software since 2003.

EggJagger Redirected Crypto Payments

Over the previous eight years, Sality’s operator used a clipjacking tool known as EggJagger to steal at least 12.1 million rubles, equivalent to roughly $150,000 in cryptocurrency, according to CrowdStrike.

EggJagger monitored device clipboards for cryptocurrency wallet addresses and replaced them with addresses controlled by the operator. As a result, payments could be redirected when victims copied Bitcoin or Ethereum addresses before making transfers.

CrowdStrike said the value of stolen digital assets that remained unspent peaked at about 147 million rubles, or roughly $1.35 million, in January 2025.

Disruption Cuts Operator Off From Infected Computers

The operation severed the Sality operator’s ability to communicate with compromised machines, according to CrowdStrike.

More than 15,000 infected computers were part of Sality’s peer-to-peer botnet. The bots checked every 40 minutes whether known peers remained online, allowing machines within the decentralized network to communicate directly with one another.

CrowdStrike said the disruption isolated those infected machines from the operator, preventing them from receiving new payload instructions or direct payload transfers.