Introduction
Beginning in January 2018 and persisting through the first half of the year, CrowdStrike Intelligence observed SALTY SPIDER, developer and operator of the long-running Sality botnet, distribute malware designed to target cryptocurrency users.
Activities and Tactics
Country of Origin: 🇷🇺 Russia
Notable Campaigns
- 2014-04
- 2018-12
- DNS hijacking is still going strong and the Win32/Sality operators have added this technique to their long-lasting botnet. This blog post describes how the malware guesses router passwords as part of its campaign to misdirect users
- Sality has terrorized computer users since 2003
- a year when personal digital assistants (PDAs) made tech headlines and office PCs ran Windows XP. Over the intervening years users traded their PDAs for smartphones and desktops migrated to newer operating systems and digital workplace solutions. Sality
- however
- https://threatvector.cylance.com/en_us/home/cylance-vs-sality-malware.html
- https://www.welivesecurity.com/2014/04/02/win32sality-newest-component-a-routers-primary-dns-changer-named-win32rbrute/
- send spam and infect new victims.
- survived the breakneck pace of technological innovation and continues to threaten organizations today.
Tactics, Techniques, and Procedures (TTPs)
Information pending cataloguing.
Notable Indicators of Compromise (IOCs)
No curated IOCs are currently published for this actor. This section will be updated when stable, attributable indicators are available.
Malware and Tools
- Sality:
Attribution and Evidence
Country of Origin: Russia Additional attribution information pending cataloguing.
References
References pending cataloguing.
Recent News
Latest articles from security news feeds mentioning this actor.
- Sality botnet infrastructure dismantled in joint global takedown BleepingComputer — 2026-09-02
- Authorities Turn Sality’s P2P Network Against Itself, Cutting Off New Malware Payloads The Hacker News — 2026-09-02