CrowdStrike Dismantles Russian Crypto-Stealing Botnet Sality

CrowdStrike, in collaboration with federal law enforcement, has dismantled the Sality botnet, which has operated for over 20 years. For the past eight years, the botnet used 'clipboard hijacking' via its 'EggJagger' payload to replace Bitcoin and Ethereum wallet addresses with attacker-controlled addresses. The operation successfully disconnected over 15,000 infected machines. Attackers stole approximately $150,000 worth of crypto, which appreciated to $1.35 million by early 2025.