Cybercrime, Fraud Management & Cybercrime
US, European Law Enforcement, Cyber Firms Target Two-Decade-Old P2P Malware Network
In a significant blow to cybersecurity threats, a collaborative effort involving law enforcement agencies from the United States and Europe, alongside cybersecurity firms such as CrowdStrike, has successfully disrupted a notorious peer-to-peer (P2P) botnet. This network, tied to Russian cybercriminals, had been thriving for over two decades, infecting more than 15,000 devices globally and pilfering at least $150,000 in cryptocurrency.
The operation, which unfolded on a recent Monday, showcased an innovative strategy of isolating infected systems from their malicious network. Law enforcement executed sophisticated maneuvers that included sinkholing and manipulating protocols, ultimately severing the connections that enabled the botnet’s operations.
The challenge of dismantling a P2P botnet lies in its very architecture; each node communicates directly with others, creating a decentralized network that is not reliant on a traditional command-and-control system. This decentralized design makes such networks particularly resilient against disruptions. However, CrowdStrike emphasized that with the right technical effort, a nuanced understanding of the underlying protocol behaviors, and effective coordination among both law enforcement and private sector players, even the most entrenched criminal infrastructures can be dismantled.
As part of the operation, the U.S. Department of Justice, along with the FBI and Defense Criminal Investigative Service, took decisive action by seizing Sality-linked domains within the United States. Concurrently, law enforcement agencies from Bulgaria, Hungary, and Romania were involved in targeting malicious websites based in Europe. Through support from Europol, CrowdStrike and the nonprofit Shadowserver Foundation contributed their technical expertise to bolster the joint initiative.
Patrick Grandy, an assistant director at the FBI’s Los Angeles Field Office, underlined the significance of this cross-border partnership. He remarked that such cooperation amplifies the FBI’s cybersecurity capabilities, particularly in neutralizing threats posed by persistent entities like the Sality botnet.
CrowdStrike identifies the Sality operations as being associated with a criminal group referred to as Salty Spider. This group is believed to be primarily based in the Republic of Bashkortostan, a region in Russia near the Kazakhstan border. Remarkably, since its inception in 2003, the Sality operator managed to maintain two overlapping P2P networks that, although sharing the same codebase, operated on different protocols and cryptographic keys.
One of the reasons for the botnet’s longevity is its capability to facilitate P2P communication, allowing infected machines to relay tasks without a central command. Sality was adept at continuously regenerating itself by attaching malware to executable files on compromised systems, thereby propagating via network shares, removable drives, and file-sharing mechanisms.
Additional payloads delivered through Sality allowed for a range of cyber-criminal activities. These included credential theft, distribution of spam, proxy services, network exploitation, and initiation of distributed denial-of-service (DDoS) attacks. A specific payload, known as EggJagger, has gained notoriety for its clipjacking capabilities, wherein it stealthily monitors users’ clipboard activities. Consequently, when users attempt to copy cryptocurrency wallet addresses, EggJagger swaps these with addresses controlled by the malicious operators. This mechanism has resulted in significant financial losses, with estimates indicating that it alone harvested a minimum of 12 million Russian rubles in cryptocurrency.
The planning for the disruption of Sality has been a lengthy endeavor, extending over several years. Efforts commenced in 2017 as cybersecurity authorities began identifying the criminal infrastructure and coordinating across different jurisdictions. According to Europol, this involved leveraging programs such as their Cyber Intelligence Extension Programme (CIEP), in which CrowdStrike and the Shadowserver Foundation provided critical technical insights and support.
Remarkably, the approach taken by cybersecurity experts was to turn the botnet’s own design against it. Since Sality’s P2P protocol lacks a centralized command and control structure, it cannot be easily patched. Attempting to roll out an updated version would risk fragmentation of the botnet, making it more challenging to manage. Given that each bot accepts peers without validating their identity, experts exploited this flaw. By masquerading as infected machines, researchers managed to join the network and manipulate protocol behaviors during peer evaluations.
Every Sality bot tracks a finite list of super peers, which are known infected machines that facilitate the P2P network. Importantly, these peers must verify their connections every 40 minutes. The collaborative effort intervened during this verification process, undermining the reputation of legitimate entries, which ultimately isolated them. Additionally, through customized sinkholes, researchers were positioned to replace compromised peers with valid entries, making it possible to monitor the campaign’s progress and notify affected users.
As machines were cut off from communication, both URL and file packs responsible for propagating Sality ceased to function, which effectively crippled the network’s infrastructure. For machines shielded by firewalls, CrowdStrike adopted a more strategic approach, waiting for them to reach out to sinkhole nodes during the routine verification cycles, thereby purging their peer listings and limiting their future accessibility to the botnet.
Law enforcement’s coordinated actions led to the disruption of the sites hosting Sality-related payloads. Given that these were distributed across various URL packs directing infected systems to malicious files on compromised servers, their removal significantly hampered the group’s ability to deliver new malicious payloads.
Today, the Shadowserver Foundation remains active, collaborating with internet service providers and computer security incident response teams to pinpoint ongoing infections and assist victims with notifications and remediation efforts. This complex operation illustrates the multifaceted nature of global cybersecurity and the determination of authorities to combat long-standing cyber threats.