- US law enforcement and international partners disrupted the Sality botnet, a Malware network active since 2003
- Sality operators used a clipboard-hijacking tool called EggJagger to steal cryptocurrency wallet addresses from victims
- The malware enabled the theft of at least $150,000 in crypto, with never-spent assets peaking at $1.5 million in January 2025
- CrowdStrike and other private sector partners assisted the takedown, cutting off criminal communication with infected machines
Federal law enforcement officials, working with Cybersecurity technology company CrowdStrike and international partners in Bulgaria, Hungary and Romania, announced action against entities behind the Sality malware that enabled the theft of $150,000 in cryptocurrency. According to the US Justice Department, the effort disrupted the Sality botnet as part of an international cyber takedown.
The Justice Department said Sality had been installing malware on compromised devices since 2003, resulting in crypto theft and cyberattacks. CrowdStrike reported that over the previous eight years, the entities behind Sality used EggJagger, a “clipjacking tool that monitors the clipboard for cryptocurrency wallet addresses and silently replaces them with addresses controlled by the operator.”
That technique allowed criminals to steal at least 12.1 million rubles, or about $150,000, in cryptocurrency. CrowdStrike noted that the value of the “never-spent” digital assets peaked at approximately $1.5 million in January 2025. “When a victim copies a Bitcoin or Ethereum address to make a payment, the funds are redirected,” the company explained.
Consequently, authorities’ efforts to disrupt the network meant the criminals behind Sality “lost the ability to communicate with infected machines.” CrowdStrike and US officials stated that about 15,000 infected computers formed part of a peer-to-peer botnet, which checked whether its systems were online every 40 minutes. Sality was used not only for crypto theft but also to power a broader network of compromised devices.
✅ Follow BITNEWSBOT on Telegram, Facebook, LinkedIn, X.com, and Google News for instant updates.
