Dismantling of the Sality Botnet After 23 Years of Activity, $150,000 Stolen in Bitcoin

The Sality botnet, active for 23 years, has been dismantled by CrowdStrike and U.S. authorities. Sality employed clipjacking methods to hijack Bitcoin and Ethereum transactions, amassing a haul of $150,000. Clipjacking involves monitoring the clipboard of an infected machine, identifying Bitcoin or Ethereum addresses, and replacing them with those of the attacker. CrowdStrike estimates the confirmed haul to be at least 12.1 million rubles, approximately $150,000. Sality survived several waves of cleanup due to its operation without a central server, allowing infected machines to communicate in a peer-to-peer manner. The dismantling operation, launched on August 31 and announced on September 1, involved the DOJ, FBI, and police in Bulgaria, Hungary, and Romania, isolating over 15,000 infected machines across four countries. Despite this dismantling, clipjacking remains a threat to other machines.

This content is provided for general informational purposes only and doesn't constitute financial, investment, legal, or tax advice. Any events, rewards, online promotions, or related information mentioned herein should not be considered a recommendation, solicitation, or invitation to purchase, sell, trade, or otherwise deal in any crypto assets. Crypto assets are highly volatile and may result in loss. The availability of WEEX services, products, and related events may vary by region. You are responsible for ensuring that your participation is in accordance with applicable local laws and regulations.