Peer Pressure: Inside the Sality Botnet Disruption Operation
CrowdStrike, Tuesday, September 1st, 2026
CrowdStrike details its role in a coordinated law-enforcement takedown of the long-running Sality peer-to-peer botnet.
CrowdStrike published a technical account of a coordinated disruption operation against Sality, a long-lived peer-to-peer botnet.
The company worked with international law enforcement and industry partners to execute the takedown, contributing telemetry and analysis of the botnet's decentralized command structure.
Because Sality has no central command-and-control server, disrupting it required understanding and acting on its peer-to-peer propagation model. The post walks through how the operation was planned and what the botnet's architecture meant for defenders.