CrowdStrike joins U.S. law enforcement to dismantle Russian Sality crypto theft botnet

PANews reported on September 2, according to CoinDesk, that U.S. cybersecurity firm CrowdStrike, together with federal law enforcement agencies, successfully dismantled the Russian Sality botnet. The malware has been active since 2003, and for the past eight years it specifically monitored the clipboard of infected computers. Once it detected an address that appeared to be BTC or ETH, it replaced it with the attacker's address, thereby quietly hijacking funds when users copied and pasted during transfers. CrowdStrike said the related addresses stole at least about 12.1 million rubles (about $150,000), and the untouched assets had once appreciated to about $1.35 million by early 2025. Sality spread through peer-to-peer communication, LAN sharing, and USB drives, and had no central server. The team exploited flaws in its node identity verification and, in a live demonstration, cut off more than 15,000 infected devices from the botnet.