- Published on
US officials work with CrowdStrike to fight malware behind crypto theft
- Authors
- Name
- DeepHorus
US officials, in a coordinated international operation with cybersecurity firm CrowdStrike, have successfully disrupted the Sality malware network, which has been used to steal approximately $150,000 in cryptocurrency over the past eight years. The U.S. Department of Justice announced on Tuesday that the joint effort, which included authorities from Bulgaria, Hungary, and Romania, along with the Shadowserver Foundation, targeted the long-running botnet. This action marks a significant step in combating malware that has compromised devices since 2003.
The operation specifically targeted Sality's ability to execute crypto theft through a tool called EggJagger. According to CrowdStrike, EggJagger is a "clipjacking tool" that monitors a victim's clipboard for cryptocurrency wallet addresses. When a user copies an address to make a payment, the malware silently replaces it with one controlled by the attackers, diverting the funds.
CrowdStrike's analysis revealed that the Sality operators stole at least 12.1 million rubles, roughly equivalent to $150,000, in cryptocurrency. While the direct theft amount was notable, the potential impact was far greater. The value of the stolen, unspent digital assets peaked at an estimated $1.5 million in January 2025, highlighting the scale of the operation.
The disruption has effectively severed the criminals' control over their network. CrowdStrike reported that the operators have now "lost the ability to communicate with infected machines." US officials confirmed that the peer-to-peer botnet, which comprised approximately 15,000 infected computers, was designed to check its systems' status every 40 minutes to maintain resilience.
The successful operation underscores the importance of public-private partnerships in cybersecurity. The collaboration between federal law enforcement and private entities like CrowdStrike and the Shadowserver Foundation was crucial for tracking and dismantling the international botnet infrastructure. This coordinated effort sent a strong message to cybercriminals.
With the command-and-control communication severed, the immediate threat from this specific Sality variant is mitigated. However, the incident serves as a persistent reminder of malware risks like clipjacking in the cryptocurrency space. Future efforts will likely focus on remediating the thousands of still-infected computers worldwide.
