Botnet takedown leaves clipboard crypto-swap malware active

On Aug. 31, defenders disrupted the Sality botnet, blocking the operator’s ability to deliver new malicious payloads. The U.S. Justice Department announced a multinational action on Sept. 1, 2026, and partners in Bulgaria, Hungary and Romania acted against related infrastructure.

The disruption altered peer lists and inserted defender-controlled sinkholes to isolate infected machines. Several URLs that hosted payloads were taken down, preventing the botnet from issuing new commands or sending additional files to those endpoints.

CrowdStrike identified EggJagger as Sality’s primary payload over the past eight years. EggJagger runs locally on compromised devices and watches the clipboard for copied cryptocurrency addresses. When it detects a Bitcoin, Ethereum or other currency address, the malware can replace it with an address controlled by the operator. If a user pastes and sends funds to the altered address, the payment is redirected.

CrowdStrike estimated the operation cut off payload delivery to more than 33,000 compromised endpoints worldwide. The company did not provide a figure for how many users lost cryptocurrency to address-swapping theft.

Sality is a file infector that attaches to executable files and spreads through network shares, removable drives and file sharing. Those infected files remain on devices independent of the botnet’s network infrastructure, so the takedown does not remove malware already installed on endpoints.

Defensive guidance points to signs of infection and remediation steps. Network operators are asked to check logs and device telemetry for UDP traffic to 188.166.101.148 as an indicator of compromise. CrowdStrike published YARA rules for scanning running processes. The Shadowserver Foundation is coordinating with internet service providers and computer security incident response teams to identify infected systems and notify affected users.

Because the clipboard-swapping component operates locally, users with confirmed infections must remove EggJagger from their machines to stop address redirection. The disruption limited the botnet’s ability to distribute new code while cleanup and notification efforts continue.