International Operation With Bulgarian Participation Disrupts Sality Botnet After Two Decades

What Happened

An international operation led by U.S. authorities and supported by Europol, Eurojust, CrowdStrike and The Shadowserver Foundation disrupted the infrastructure of Sality, one of the longest-running botnets in the world.

The operation took place on 31 August 2026 and involved actions in the United States, Bulgaria, Hungary and Romania. The U.S. Department of Justice explicitly names Bulgaria’s General Directorate Combating Organized Crime among the institutions that provided crucial assistance.

Sality has been active since 2003 and for more than two decades has been used to infect devices, distribute additional malware, steal cryptocurrency, send spam and support distributed denial-of-service attacks.

Why Sality Was So Persistent

Sality did not rely on a single central command server. It operated as a peer-to-peer botnet — a decentralized network in which infected devices communicate with each other and exchange instructions through the network itself.

This model makes disruption harder. In a traditional malicious infrastructure, investigators can focus on specific servers or domains. With Sality, there is no single point that can be switched off to stop the entire network.

Sality is also a file-infecting malware. It attaches itself to executable files and can spread through network shares, removable drives and file sharing. This allows infections to regenerate even when individual parts of the infrastructure are disrupted.

How the Network Was Disrupted

According to CrowdStrike, the operation used a weakness in the way infected devices maintain lists of other devices in the network. Instead of looking for one central server, the operation redirected infected machines toward controlled infrastructure used for monitoring, isolation and notification.

This approach allowed infected devices to be gradually separated from the operator’s control infrastructure. Once that happened, they could no longer receive new instructions or new malicious files through the Sality network.

In parallel, U.S. authorities seized domains linked to Sality, while partners in Bulgaria, Hungary and Romania took action against additional domains hosted in Europe.

What “Botnet Disruption” Means

This operation does not mean that every infected device has been automatically cleaned. That distinction matters.

Disrupting the botnet limits the operator’s ability to control infected devices and send them new malicious files. But if a device is already infected, the local problem remains and must be remediated.

That is why Shadowserver is working with internet service providers and computer security incident response teams to identify infected systems and support victim notification and remediation.

Why This Matters for Organizations

Sality is an example of long-lived malicious infrastructure. It shows that old threats do not disappear automatically simply because they are no longer new.

In many organizations, infected devices may remain unnoticed when there is not enough visibility into network traffic, processes, unusual behavior and connections to external infrastructure.

The risk is not only the infected device itself. It can be used to distribute additional malware, participate in distributed denial-of-service attacks, send spam, steal cryptocurrency or support broader criminal infrastructure.

What Teams Should Check

Organizations should use this moment not only as news of a successful international operation, but as a reason to check whether residual infections exist in their own environments.

Practical checks:

• whether any systems show signs of Sality infection;
• whether unusual network traffic to known indicators is present;
• whether UDP traffic to the public “lighthouse” IP address shared by CrowdStrike exists;
• whether executable files show unexpected changes;
• whether there are signs of propagation through network shares or removable media;
• whether devices have outdated protection or missing updates;
• whether there is visibility over endpoints that are not always connected to the office network;
• whether there is a process for local cleanup and re-checking after infection is found.

The key question is not only whether the botnet was disrupted globally. It is whether the specific organization can prove it is not still hosting infected devices in its own environment.

DIAMATIX Comment

From the DIAMATIX perspective, the Sality operation shows why cybersecurity resilience is not only about responding to new threats.

Long-lived botnets remain active because they combine infected devices, weak control, limited visibility and infrastructure that cannot be easily disrupted by one country or one provider.

SOC (Security Operations Center) and MDR (Managed Detection and Response) processes matter in these cases. They connect network traffic, endpoint behavior, indicators of compromise, processes, logs and external intelligence.

This allows an organization to detect an infection before it needs a global takedown to reveal the problem. The organization can isolate the affected device earlier and cut its connection to criminal infrastructure.

Questions for CISO and IT Teams

• Do we have visibility over all endpoints, including old or rarely used systems?
• Do we detect unusual outbound traffic to known malicious infrastructure?
• Do we check for residual infections after international botnet takedowns?
• How do we detect malware that attaches itself to executable files?
• Can we isolate a device quickly without disrupting a critical business process?
• Do we have a process for notification, cleanup and re-checking?
• Do we use external indicators of compromise in daily monitoring?

The practical takeaway: disrupting botnet infrastructure is an important step, but organizational protection depends on whether infected devices are found, isolated and cleaned.

Check whether old threats remain active in your environment

DIAMATIX can help assess endpoints, network traffic, indicators of compromise and response readiness for botnet infections and other long-lived threats.

Request a visibility and response readiness review with DIAMATIX.
Trusted · Innovative · Vigilant

Sources

• Europol. Global public-private operation disrupts Sality botnet active for two decades.
• U.S. Department of Justice. Sality Malware Disrupted in International Cyber Takedown.
• CrowdStrike. Peer Pressure: Inside the Sality Botnet Disruption Operation.
• Reuters. Russian cybercrime operation being dismantled after two decades.
• BleepingComputer. Sality botnet infrastructure dismantled in joint global takedown.
• The Sofia Globe. Bulgaria takes part in global operation to disrupt Sality botnet.

This article summarizes publicly available information as of September 2026.