Home›Crypto›Market Structure›Sality disruption stops new malware delivery, but addr…

Sality disruption stops new malware delivery, but address swapping persists

CrowdStrike said the Sality botnet had enabled payload distribution to more than 33,000 infected machines, so users with confirmed infections still need to remove installed address-swapping tools.

Reported · Written up by our desk · Market Structure

A Sality botnet disruption has cut off the operator’s ability to deliver new malicious software to infected computers, but existing malware can still redirect cryptocurrency payments, according to CrowdStrike and summarized by CryptoSlate.

CrowdStrike said the botnet remained active on devices already compromised, including malware that swaps cryptocurrency payment addresses by monitoring a user’s clipboard. The software can substitute addresses controlled by the operator when someone copies a Bitcoin or Ethereum address, and the redirection takes effect if funds are sent to the substituted destination.

The firm said the Sality operation enabled payload distribution to more than 33,000 infected machines worldwide, while it did not specify how many users lost cryptocurrency. It identified EggJagger as Sality’s primary payload over the preceding eight years.

CrowdStrike described Sality as a file infector that attaches to executable files and spreads through network shares, removable drives, and file sharing. The disruption changed peer communication for infected machines by inserting defender-controlled sinkholes, and for network operators it recommended checking logs and telemetry for UDP traffic to a listed “lighthouse” address, with a match indicating an infection that requires remediation.

Latest closeBitcoin $78,593.99 ▼0.7%|Ethereum $2,494.80 ▲0.1%

More like this

Sources