The US, Bulgaria, Hungary and Romania have neutralized the infrastructure of the Sality malware

The United States, Bulgaria, Hungary and Romania took part in an international operation to neutralize the Sality botnet, a malware infrastructure associated with Russia and used for cybercrime. The action, announced by the US Department of Justice and Europol, targeted servers and domains used to control the network, as well as to distribute the malicious software.

As part of the operation, US authorities, including the FBI and DCIS, seized servers and domains in the United States. In Europe, partners in Bulgaria, Hungary and Romania took action against other domains associated with Sality. Romania was represented by the Romanian Police, the Directorate for Combating Organized Crime and the Central Cybercrime Unit.

Sality has been operating since 2003 and has infected millions of computers, which were subsequently used to steal cryptocurrencies, conduct cyberattacks and send spam messages. At its peak, the botnet provided access to more than one million devices simultaneously, while more than 11 million IP addresses were associated with its infrastructure.

The operation relied on the “sinkholing” technique, through which communications from infected devices were redirected away from the criminals’ servers. The measure isolated the compromised computers and rendered the hackers’ command channel unusable. The action also received support from CrowdStrike, the Shadowserver Foundation, Eurojust and Europol.