# CrowdStrike and FBI Takedown 23-Year-Old Sality Botnet One of the world's oldest cyber threats neutralized through innovative operation. - **Source:** [The Next Web](https://brifing.si/source/afe24b20-b275-4c19-b9a6-8bb3c8babae7) - **Published:** 2026-09-02 - **Topic:** [Software & Engineering](https://brifing.si/c/engineering) - **Original article:** - **On Brifing:** https://brifing.si/s/f7a26ada-793e-4861-b603-bee4086b9cbf ## 23-Year-Old Digital Menace The Sality botnet has been active since 2003, predating both iPhone and Facebook. For years, it facilitated spam campaigns, DDoS attacks, and cryptocurrency theft. Its peer-to-peer architecture and executable file infection method helped evade conventional security measures. Announced at CrowdStrike's Day Zero summit in Las Vegas, this operation marks a milestone in cybersecurity history. ## Innovative Takedown Method CrowdStrike researchers reverse-engineered the botnet to identify vulnerabilities, then seeded it with false data to disconnect infected machines from their controllers. This technique demonstrates potential for dismantling distributed networks without brute force attacks. Lead researcher Tillmann Werner called it their most complex botnet takedown ever executed. ## Legal and Technical Coordination The FBI and DOJ seized control domains while CrowdStrike handled technical disruption. David Watson of Shadowserver Foundation emphasized Sality's role as entry point for numerous organizations. The botnet's real value lay in providing access to compromised networks for resale or further attacks. The operation also tested new US policies authorizing private companies to conduct overseas cyber operations. ## Old But Still Dangerous Sality proves older threats persist beneath newer ones' shadows. European industrial systems and government agencies running 2003-era software remain vulnerable. The infection's longevity reflects victims' failure to update systems or recognize compromises. First Assistant US Attorney Bill Essayli reiterated that cybercriminals represent a 'clear and present danger'. ## No Permanent Solution Guaranteed History shows botnets often rebuild after takedowns. Computers disconnected today still harbor the original vulnerabilities. As AI-driven threats dominate discussions from FSB warnings to OpenAI disclosures, this operation reminds us not to overlook persistent older threats. The cybersecurity conversation must address both emerging and enduring risks. ## Private Sector's Expanding Role CrowdStrike's false data deployment blurs lines between defense and offense. New US authorizations for private cyber operations abroad signal industry transformation. While this operation showcases successful public-private partnership, the inability to prosecute operators highlights limitations of infrastructure-focused approaches. ## Sector Impacts and Risks Though Sality's full scale remains undisclosed, experts estimate global impact. SMEs, government entities, and industrial plants with legacy systems remain particularly vulnerable. Despite this success, warnings persist about similar active botnets and potential new variants. The operation underscores the critical need for proactive cybersecurity measures across all sectors. ## New Cybersecurity Paradigm Sality's takedown establishes a model for combating sophisticated threats requiring creative solutions beyond conventional methods. False data injection techniques may see wider adoption. The operation also demonstrates the vital role of international cooperation in cybercrime fighting. After 23 years, this success provides the security community with significant morale boost and valuable lessons. ## Sources covering this story - https://thenextweb.com/news/crowdstrike-and-the-fbi-are-dismantling-sality-after-23-years — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._