{"id":12959,"date":"2026-09-08T14:52:34","date_gmt":"2026-09-08T14:52:34","guid":{"rendered":"https:\/\/cryptonews.uk.com\/?p=12959"},"modified":"2026-09-08T14:52:34","modified_gmt":"2026-09-08T14:52:34","slug":"sality-botnet-disrupted-but-crypto-stealing-malware-remains","status":"publish","type":"post","link":"https:\/\/cryptonews.uk.com\/?p=12959","title":{"rendered":"Sality botnet disrupted, but crypto-stealing malware remains"},"content":{"rendered":"

<\/p>\n

\n

The Aug. 31 disruption of the Sality botnet cut off its operator’s ability to deliver new malicious software to infected computers, while malware already on those devices remained active, according to CrowdStrike’s Sept. 1 report. Users of infected machines still need to remove the installed malware, including a tool that swaps cryptocurrency addresses and can redirect payments.<\/p>\n

CrowdStrike said the botnet enabled payload distribution to more than 33,000 infected machines worldwide. The figure measures compromised computers; the number of users who lost cryptocurrency remains unspecified.<\/p>\n

The Justice Department announced the multinational operation on Sept. 1, 2026, following the action the previous day. U.S. authorities seized Sality-linked domains, while partners in Bulgaria, Hungary and Romania acted against additional domains.<\/p>\n

How the payment risk survives<\/h2>\n

CrowdStrike identified EggJagger as Sality’s primary payload over the preceding eight years. The tool watches the clipboard for cryptocurrency addresses and substitutes ones controlled by the operator, including when someone copies a Bitcoin or Ethereum address for a payment.<\/p>\n

The dangerous step is sending to the substituted address. A user can intend to pay the correct recipient yet paste a different destination into the payment form. The redirection takes effect if the user sends funds to that destination.<\/p>\n

\n

Related Reading<\/span><\/p>\n

CryptoBandits malware lets criminals use your USB drive to access crypto wallets \u2013 Microsoft warns<\/h3>\n<\/p>\n

<\/span> <\/div>\n

Address-swapping software already installed on a computer can keep operating after Sality’s communications are cut off. Users with a confirmed infection therefore still need to have the malware removed from their devices.<\/p>\n