Threat Intel
CrowdStrike & Partners Strike Down Sality Botnet in Coordinated Disruption
In a joint effort with international law‑enforcement agencies and industry allies, CrowdStrike executed the “Peer Pressure” operation to dismantle the Sality peer‑to‑peer botnet. The campaign severed command‑and‑control channels, seized malicious infrastructure, and disrupted the botnet’s ability to distribute ransomware and other payloads. The takedown removes a key threat vector that has infected millions of hosts worldwide, demonstrating the power of coordinated cyber‑defense operations.
On September 1, 2026, CrowdStrike announced the successful execution of the "Peer Pressure" operation, a coordinated effort that brought the Sality peer‑to‑peer botnet to a halt. By working hand‑in‑hand with law‑enforcement agencies and industry partners, the team was able to sever the botnet’s command‑and‑control infrastructure, seize malicious domains, and disrupt its ability to spread malware.
Why Sality Matters
Salient for its resilience and stealth, Sality has been a persistent threat since 2017. The botnet’s decentralized architecture makes it difficult to take down, yet it has been responsible for the delivery of ransomware, data‑exfiltration tools, and other malicious payloads to millions of infected machines across the globe.
The Disruption Playbook
- Coordinated takedown: Joint operations with international law‑enforcement agencies ensured synchronized actions against key infrastructure nodes.
- Infrastructure seizure: Malicious domains and hosting services were seized, cutting off the botnet’s communication backbone.
- Threat intelligence sharing: Real‑time data was shared with industry partners, allowing them to patch vulnerabilities and block malicious IPs.
- Legal enforcement: Arrest warrants were issued for operators behind the Sality network, adding a deterrent layer to future attacks.
Impact on the Threat Landscape
The disruption removed a major vector for ransomware and data‑exfiltration campaigns. Early post‑operation analysis indicates a significant drop in new infection rates and a halt in the botnet’s ability to propagate.
"The success of Peer Pressure underscores the effectiveness of coordinated cyber‑defense, blending technical disruption with legal action to neutralize a long‑standing threat," said a CrowdStrike spokesperson.
Key Takeaways for Defenders
- Invest in threat‑intelligence feeds that can quickly identify botnet infrastructure.
- Collaborate with law‑enforcement to ensure swift takedown of malicious assets.
- Maintain robust network segmentation to limit the spread of peer‑to‑peer malware.
- Leverage automated response workflows to isolate infected hosts before they can communicate with command‑and‑control servers.
Related articles
PhantomRaven: The Bug‑Hunter‑Made JavaScript Stealer Exposed by CrowdStrike
CrowdStrike has identified a financially motivated threat actor who pretends to be a bug bounty hunter and built PhantomRaven, a JavaScript‑based information stealer fueled by an LLM. The tool harvests credentials and sensitive data by exploiting common web vulnerabilities and maintaining stealthy persistence. RootPwn breaks down its operation, distribution methods, and the broader impact on web security.
Read briefing
CrowdStrike Enhances Falcon with Real‑Time Supply‑Chain Defense
CrowdStrike has rolled out a new supply‑chain protection layer inside its Falcon endpoint sensor, blocking malicious open‑source packages as they download. The update expands Falcon’s threat‑intelligence reach, allowing defenders to stop supply‑chain attacks before code ever executes on the host. RootPwn breaks down how the feature works, its impact on the attack surface, and what it means for organizations still hunting for zero‑day supply‑chain exploits.
Read briefing
PhantomRaven: LLM‑Powered JavaScript Stealer Created by a Bug‑Bounty Hunter
CrowdStrike has exposed PhantomRaven, a JavaScript‑based information stealer crafted with large language model techniques and distributed by a financially motivated threat actor who pretends to be a bug‑hunter. The malware siphons credentials, session tokens, and other sensitive data from web apps, leveraging the same expertise used to discover and report bugs. RootPwn breaks down how LLMs are enabling rapid, low‑cost stealers and outlines the signs defenders should watch for.
Read briefing
Ransomware Landscape Shifts: Q2 2026 Report Highlights Growing Competition and AI‑Accelerated Ops
Check Point Research’s Q2 2026 ransomware report shows the ecosystem is still dominated by a handful of RaaS groups, but the tail is widening: 93 active actors now versus 71 in Q1, with the top 10 accounting for 57.6 % of victims (down from 71 %). Victim numbers stayed flat quarter‑on‑quarter, yet the US share dropped to 42 % as new groups like The Gentlemen and Krybit target fewer American targets. The Gentlemen’s internal leak revealed an AI‑powered ransomware‑management panel built in three days, marking the first hard evidence that generative‑AI is speeding up malicious tool development. P
Read briefing