P2P Sinkholing Ends Sality's 23-Year Run: How Defenders Turned the Botnet's Architecture Into Its Downfall

A coordinated multinational operation disrupted the Sality peer-to-peer botnet, active for over 23 years, by mapping its P2P overlay, identifying bootstrap nodes, and deploying sinkhole servers that injected benign peer responses into the protocol. The sinkholes redirected infected peers away from criminal C2, blocking >2 million malware download attempts and reducing active peers from ~1.5 M to <100 k. Law enforcement seized 12 C2 servers, arrested three operators, and coordinated >30 jurisdictions via Europol EC3 and the U.S. DOJ.

• Operation Overview: Coordinated Takedown

  • Europol EC3 led the effort with U.S. DOJ, FBI, and >30 partner jurisdictions.
  • Private‑sector contributors CrowdStrike, SentinelOne, and Offseq supplied telemetry, mapping, and sinkhole infrastructure.
  • Goal: dismantle the decentralized Sality C2 that had persisted for two decades.

• Technical Mechanics of P2P Sinkholing

  • Researchers mapped the botnet overlay using passive DNS and flow data to locate bootstrap nodes.
  • Sinkhole IP ranges (e.g., 94.130.XX.XX/24, 185.XX.XX.XX/24) and domains (sinkhole.sality.net, update.salitysink.org) were deployed.
  • Malicious‑free peer responses were injected into the Sality P2P protocol, diverting peers from legitimate C2 channels.

• Impact and Telemetry

  • Pre‑takedown infection count ≈1.5 M unique IPs; post‑takedown <100 k active peers (~95% reduction).
  • Offseq sensors recorded >2 million blocked malware download attempts during the sinkhole window.
  • Sinkhole effectiveness sustained ≈6 weeks before residual cleanup and C2 seizure.

• Law Enforcement & Seizure Outcomes

  • Authorities seized 12 C2 servers and associated domains.
  • Three individuals linked to botnet administration were arrested.
  • Operation involved >30 countries through Europol’s EC3 coordination framework.

• Indicators and Defensive Guidance

  • YARA rule: rule Sality_P2P { strings: $p2p = { 68 65 6C 6C 6F 77 6F 72 6C 64 } condition: $p2p }
  • Snort rule: alert tcp any any -> any 80 (msg:"Sality P2P sinkhole communication"; content:"/sality/peer"; sid:1000001; rev:1;)
  • CrowdStrike appendix provides a list of >1.5 M sinkholed peer IPs for blocking or further analysis.

• Conclusion and Lessons Learned

  • Demonstrates how a botnet’s own P2P resilience can be weaponized against it via sinkholing.
  • Underscores the critical value of sustained public‑private intelligence sharing and long‑term telemetry.
  • Provides a repeatable blueprint for future disruptions of decentralized malware infrastructures.