On 31 August 2026, the US Department of Justice, with authorities in Bulgaria, Hungary and Romania and private partners CrowdStrike and the Shadowserver Foundation, sinkholed the Sality peer-to-peer network and seized malware-hosting domains across the US and Europe.

Sality has been running since 2003. It is older than most of the machines it infects.

The flaw they exploited was missing authentication

Sality has no central server to seize. Infected machines find each other, and that is the whole design — which is also where it broke.

The malware trusted any peer that spoke its protocol, without verifying who was on the other end. So the investigators became peers.

The technique is peer list manipulation. Every 40 minutes, an infected machine checks the status of the peers it knows about. Investigators used that cycle to strip legitimate peers out at the protocol level and substitute entries pointing at sinkholes they controlled. Super peers — the nodes that hold the network together — went first. Machines behind firewalls were picked off afterwards, on their own cycles.

Two Sality networks, version 3 and version 4, were live until the disruption. More than 15,000 infected machines were reachable for payload delivery.

Read the mechanism again, though, because it is familiar. A protocol that accepts instructions from an unauthenticated party is the same class of defect this site writes about in enterprise products most weeks. Here it happened to be in malware, and the people who found it useful happened to have badges.

That is worth sitting with rather than cheering. The capability that ended Sality is not a law-enforcement superpower. It is a missing authentication check.

"Takedown" is doing a lot of work

Three things did not happen.

Nobody was arrested. No arrests are reported in connection with the operation. The threat actor is described as operating from Russia's Republic of Bashkortostan, which is not a jurisdiction that responds to US indictments.

The malware was not removed. Every one of those 15,000 machines is still infected. CrowdStrike's own guidance is explicit: existing malware on those systems remains active and should be removed. Sinkholing changed who the bots call, not what is on them.

The infections were not fixed at source. Sality spreads by modifying Windows executables. That mechanism is untouched.

What actually changed is that the operator lost the ability to push new payloads to a network he had been running for over twenty years. That is a real result, and it is much smaller than the word "takedown" implies. Compare it with the Commerzbank case, where the arrests happened within four days — that is what disruption plus accountability looks like.

The remediation bill just moved to 15,000 people

This is the part that will not get written up.

Before Sunday, 15,000 machines were infected and their owners mostly did not know. After Sunday, 15,000 machines are infected, their owners still mostly do not know, and the only party who was actively paying attention to them — the operator — no longer is. Nothing about the machines changed. The list of people responsible for them did.

Sinkhole data gets passed to national CERTs and ISPs, who notify downstream. That process works, slowly, and it works best for organisations that have someone to receive a notification. A small business running an infected workstation from 2019 does not.

What to check

  • Look for UDP traffic to 188.166.101[.]148 in network logs. That is the sinkhole. Anything of yours talking to it is infected and needs cleaning, not congratulating.
  • Sality infects executables. Remediation is not "delete a file" — assume binaries on the host are modified and rebuild rather than clean.
  • Check for it on the machines nobody logs into. A 23-year-old file infector survives on the estate that estate management forgot: build servers, kiosks, lab machines, the PC attached to a machine tool.
  • Do not treat the sinkhole as protection. It is a redirect maintained by a private company, for as long as that company maintains it.

What is not established

  • Whether the sinkholing is permanent. Sinkholes are maintained infrastructure. Nothing published says for how long.
  • Whether the operator can rebuild. The peer protocol's trust model is the weakness; a version 5 that authenticates peers is not a hard piece of engineering.
  • The true infection count. 15,000 is what was reachable through the P2P network during the operation, not a census.
  • Any attribution beyond geography. "Operating from Bashkortostan" is a location, not an identification, and no charges are reported.
  • What proportion of the 15,000 will actually be cleaned. Historically, the answer to this is not encouraging, and nobody publishes the follow-up.