Authorities disrupt Sality botnet that redirected bitcoin and ether payments

Europol said more than 11 million unique IP addresses had been linked to the infrastructure over its lifetime, while the active operation involved more than 15,000 machines. Those figures describe observed infrastructure and historical associations, not a count of devices that are still infected today.

The botnet's durability came from decentralized peer trust. Infected computers communicated directly, spread malicious code through executable files and did not depend on one central command server that investigators could simply seize.

Clipboard theft turned ordinary payments into traps

For the past eight years, Sality's main payload was EggJagger, a clipjacking tool that watched a computer clipboard for cryptocurrency addresses. When a user copied a Bitcoin or Ethereum address, the malware silently replaced it with an address controlled by the operator.

CrowdStrike estimated at least 12.1 million rubles, roughly $150,000, was stolen through EggJagger alone. The firm also said the operator's unspent holdings peaked at a much higher nominal value in January 2025. Estimates cover one payload family and should not be read as a complete accounting of every Sality crime.

The practical lesson is verify the destination address on the receiving device immediately before signing. The takedown reduces one criminal channel, but clipboard malware, fake browser extensions and address substitution remain live attack patterns. Sinkholing also identifies victims; users should rely on official notifications and security updates, not unsolicited recovery offers.

Security teams should also remove malware from infected devices, review browser extensions and rotate credentials where appropriate. A successful takedown blocks one infrastructure layer but does not automatically clean every endpoint that interacted with it.

Users should treat wallet addresses as sensitive transaction data and compare them character by character on a trusted display before confirming payment.