CrowdStrike and Federal Authorities Dismantle Long-Running Russian Malware Targeting Cryptocurrency

A multinational operation led by CrowdStrike, the Department of Justice (DOJ), the FBI, and European law enforcement has successfully dismantled the Sality botnet, a peer-to-peer network that has been stealing cryptocurrency for nearly eight years. The operation, which began on August 31 and was announced on September 1, specifically targeted the botnet's crypto-focused payload known as EggJagger, which hijacked clipboard data to redirect Bitcoin and Ethereum transactions to wallets controlled by the attackers.

The Sality malware has been active since 2003, infecting over 15,000 devices and engaging in various cybercrimes, including spam campaigns and distributed denial-of-service attacks. The shift to cryptocurrency theft began approximately eight years ago, with the EggJagger payload enabling the malware to monitor victims' clipboard data and swap copied wallet addresses with those of the attackers. This method allowed the operator, identified as SALTY SPIDER and believed to be based in Russia, to steal at least 12.1 million rubles (around $150,000).

The takedown involved isolating infected machines and seizing critical domains, effectively disrupting the botnet's operations. The Shadowserver Foundation is now assisting in notifying victims and helping them remediate the infections. CrowdStrike provided the necessary threat intelligence, while law enforcement agencies coordinated the legal actions required to dismantle the network. The future of potential prosecution for SALTY SPIDER remains uncertain due to the operator's location in Russia.

© 2026 KLEA News. All Rights Reserved. This article is provided for informational purposes only. It is not offered or intended to be used as legal, tax, investment, financial, or other advice.

Source: KLEA News