CrowdStrike and US authorities dismantle Sality crypto botnet live
CrowdStrike and US authorities just took down Sality, a botnet that's been quietly swiping crypto for eight years.
Using EggJagger, Sality's main payload, Sality intercepted and changed cryptocurrency transactions by messing with clipboard data.
The operation was pulled off live at CrowdStrike's Day Zero summit in Las Vegas.
CrowdStrike hijacked Sality's peer checks
Sality spread through USB drives and worked as a decentralized peer-to-peer network, letting infected computers keep the botnet alive.
CrowdStrike found a weakness: every 40 minutes, infected devices checked whether their known peers were still online. By hijacking this process, they cut off more than 15,000 machines from the network.
CrowdStrike estimated that Sality stole at least $150,000 worth of crypto and at one point held up to $1.35 million during last year's surge, pretty wild for something running out of Russia.