Authorities Disrupt Sality P2P Botnet, Sever Malware Payload Distribution

The U.S. Department of Justice (DoJ) on Tuesday announced the takedown of a long-standing peer-to-peer (P2P) botnet known as Sality as part of a coordinated law enforcement operation. The effort was undertaken on August 31, 2026, by authorities from the U.S., Bulgaria, Hungary, and Romania, in collaboration with private industry partners CrowdStrike and the Shadowserver Foundation. According to the DoJ, the operation disrupted the Sality botnet's update mechanism, preventing new malware payloads from being delivered to infected systems. Sality has been active for decades and uses a P2P architecture to propagate and update malware on compromised hosts. The coordinated action severed the distribution channel that operators relied upon to push updated malware and commands. While the takedown disrupts future payload distribution, existing malware residing on infected systems remains unless cleaned through antivirus or endpoint protection tools. Industry partners CrowdStrike and the Shadowserver Foundation supported the operation. The full technical details of the disruption method are not publicly disclosed. Authorities advise users to ensure antivirus/endpoint protection is updated and to perform full system scans to detect and remove any lingering Sality infections.