techjacksolutions.com • 2h
P2P Sinkholing Ends Sality's 23-Year Run: How Defenders Turned the Botnet's Architecture Into Its Downfall
A coordinated multinational operation disrupted the Sality peer-to-peer botnet, active for over 23 years, by mapping its P2P overlay, identifying bootstrap nodes, and deploying sinkhole servers that injected benign peer responses into the protocol. The sinkholes redirected infected peers away from criminal C2, blocking >2 million malware download attempts and reducing active peers from ~1.5 M to <100 k. Law enforcement seized 12 C2 servers, arrested three operators, and coordinated >30 jurisdictions via Europol EC3 and the U.S. DOJ.