US, CrowdStrike say Russian cybercrime ring dismantled after two decades

• Sality used a peer-to-peer architecture across a diffuse network of compromised machines, making it particularly resistant to law enforcement action for over 20 years
• CrowdStrike defeated the botnet by reverse-engineering its structure and seeding it with bogus information that tricked components into cutting themselves off from their creator
• The Russia-based operation's creator remains unidentified and at large, with security experts now monitoring whether they will attempt to regain control or rebuild the network

Summary: Russian Cybercrime Network "Sality" Dismantled After 20 Years

U.S. law enforcement and cybersecurity firm CrowdStrike (CRWD) announced the takedown of a Russian hacking operation called "Sality" that had been active since 2003, making it one of the internet's longest-running cybercriminal enterprises.

Key Actions Taken:

• U.S. officials seized web domains used by hackers to control compromised computers
• CrowdStrike disconnected the botnet's network of infected machines from its controller
• The dismantling began Monday, September 1 at CrowdStrike's Day Zero summit in Las Vegas
• Operation coordinated with FBI, U.S. Justice Department, European law enforcement, and The Shadowserver Foundation

Technical Details:

Sality's peer-to-peer architecture made it exceptionally resilient to takedown efforts, as it could receive commands through a diffuse network of compromised machines. CrowdStrike exploited this design by seeding the network with bogus information, tricking botnet components into severing themselves from their creator.

CrowdStrike researcher Tillmann Werner described this as "the most complex botnet takeover we have ever done," requiring painstaking reverse-engineering work.

Criminal Activities:

The Russia-based operation was used to:

• Send spam
• Conduct distributed denial-of-service (DDoS) attacks
• Steal cryptocurrency

Market Implications:

First Assistant U.S. Attorney Bill Essayli emphasized that "cybercriminals, botnets, and malware are a clear and present danger to our nation's security and economy." While Sality has been overshadowed by modern ransomware groups, experts warn it remains "a vector into a lot of organizations."

The botnet's creator remains unidentified, and experts are monitoring whether they will attempt to regain control or rebuild the network.