Sality Botnet Dismantled; It Previously Stole Funds by Tampering with BTC and ETH Receiving Addresses.

CrowdStrike and the U.S. Department of Justice (DOJ) announced the takedown of the Sality peer-to-peer (P2P) botnet, isolating more than 15,000 infected devices globally. The botnet has been spreading since 2003, and over the past eight years has primarily deployed a clipboard hijacking tool called EggJagger to steal funds from Bitcoin (BTC) and Ethereum (ETH) transfers. EggJagger monitors the crypto wallet addresses copied by victims and replaces them with addresses controlled by attackers, diverting transferred funds to the threat actors. CrowdStrike estimates that the tool alone has stolen at least $150,000 worth of crypto assets; as most of the funds have not been moved, the associated holdings rose to approximately $1.35 million in January 2025. The U.S. DOJ, FBI, and Defense Criminal Investigative Service (DCIS) have seized relevant domains in the U.S., while police in Bulgaria, Hungary, and Romania shut down the botnet’s European infrastructure. Infected devices have now been redirected to traffic receiving servers controlled by CrowdStrike, but the original malware on the devices remains active until manually removed.