Cops, CrowdStrike disrupt Sality botnet by poisoning the network and diverting into sinkholes
Summary
Law enforcement and cybersecurity firm CrowdStrike have successfully disrupted the Sality botnet, which has been active for 23 years. The operation involved poisoning the botnet's network and diverting its traffic into sinkholes.
IFF Assessment
FOE
The disruption of a long-standing botnet is good news for defenders, indicating successful takedown efforts against malicious infrastructure.
Defender Context
The successful takedown of the Sality botnet highlights the ongoing efforts to dismantle persistent cyber threats. Defenders should be aware that older botnets can still pose a significant risk and that such disruptions can sometimes lead to shifts in threat actor tactics or the emergence of new infrastructure.