Sality

Sality is a long-running Windows malware family first observed in 2003. It is a polymorphic executable-file infector that evolved into a decentralized peer-to-peer botnet and malware-delivery platform. It infects Windows executables, propagates through network shares and removable storage, and enrolls compromised hosts into a custom P2P network that distributes signed payload instructions and, in later variants, payload files directly.

Sality incorporates substantial defense-evasion and persistence functionality, including process injection, security-product termination, interference with security updates and resources, Windows security-configuration tampering, and kernel-level components in some variants. Historical variants also performed keylogging, credential theft, and data exfiltration. The botnet has delivered spam relays, proxy components, information stealers, web compromise tooling, distributed password-cracking payloads, and DDoS payloads.

A major long-term payload family delivered through Sality was EggJagger, which hijacked cryptocurrency wallet addresses copied to the clipboard to redirect payments to attacker-controlled wallets. Sality operations have primarily been assessed as financially motivated, although the botnet has also been used in DDoS campaigns with apparent politically aligned and personal-grievance motivations. CrowdStrike tracks activity associated with Sality under the SALTY SPIDER designation. International law-enforcement and private-sector partners disrupted Sality's P2P infrastructure through sinkholing, preventing affected bots from receiving new tasking and payloads; compromised endpoints and previously delivered payloads still require remediation.