US officials work with CrowdStrike to disrupt malware tied to crypto theft
Sality botnet disruption stops crypto theft and blocks malicious clipboard hijacking Federal authorities and CrowdStrike cut command access, protecting wallets and funds
US federal authorities, working with cybersecurity firm CrowdStrike and several international partners, have disrupted a malware operation linked to cryptocurrency theft.
The Justice Department said the action targeted the Sality botnet, which had been used for years to infect devices and deploy tools that monitor clipboard data and replace copied crypto wallet addresses with attackercontrolled addresses. CrowdStrike said the scheme helped steal about $150,000 in cryptocurrency over the past eight years, with the value of the stolen assets at one point reaching about $1.5 million.
Officials said the operation involved law enforcement from the United States, Bulgaria, Hungary and Romania, along with privatesector partners including the Shadowserver Foundation. According to CrowdStrike, the disruption cut off the criminals’ ability to communicate with infected machines and affected a botnet of roughly 15,000 computers.