Police used Sality's own peer list against it. The 15,000 machines are still infected
2026-09-02Security
Sality trusted any peer that spoke its protocol, so investigators became its peers and substituted sinkholes for the real ones. The operator is reportedly still in Bashkortostan, no arrests are reported, and the malware sitting on every one of those machines is exactly where it was on Sunday.