Russian malware Sality for years replaced cryptocurrency wallet addresses in the clipboard and redirected payments to attackers’ accounts. CrowdStrike, together with federal law enforcement agencies, disconnected more than 15,000 infected devices from the network by exploiting a weakness in the botnet’s communication mechanism.
Main Points
- CrowdStrike and federal law enforcement disrupted Sality—a Russian botnet that intercepted cryptocurrency transfers by replacing copied wallet addresses.
- The malware did not rely on a single central server: infected devices communicated directly with each other, and it spread via network drives and USB drives.
- Over 8 years, the scheme brought attackers at least 12.1 million rubles, about $150,000. Later, the value of some untouched assets grew to about $1.35 million.
How Sality Replaced Cryptocurrency Addresses
The scheme was simple and therefore dangerous. Bitcoin and Ethereum wallet addresses look like long strings of characters, so users almost always copy them instead of typing them manually. The attack was based on this habit.
The Sality payload, which CrowdStrike called EggJagger, monitored the clipboard on the infected computer. If a string resembling a Bitcoin or Ethereum address appeared there, the program silently replaced it with an address controlled by the attacker.
The user would paste the already replaced address into the wallet, confirm the transfer—and the cryptocurrency would go not to the intended recipient, but to the attack operator. No warnings appeared, and it was impossible to reverse such a transaction after sending.
The most reliable protection in this situation remains simple:
- Check the first and last characters of the address after pasting.
- Use only trusted devices for transfers.
- Scan the device for malware.
Why the Botnet Was Hard to Neutralize
Sality did not work like a typical service with a single point of control. It had no central server that could simply be disabled. Infected computers communicated directly with each other and checked about every 40 minutes which known nodes remained online.
In terms of spreading, Sality resembled both a computer virus and a network worm: it attached itself to programs on network resources and USB drives, then restored itself without an explicit command from the operator. This approach allowed the botnet to remain resilient on the internet for a long time.
Any computer that responded in the expected way was accepted as part of the network without additional identity verification. This vulnerability in computer security became the entry point for the CrowdStrike operation.
The company replaced real node addresses with its own servers, thereby cutting off more than 15,000 infected machines from the botnet. The operation was carried out on Monday during a demonstration at the Day Zero summit in Las Vegas.
What This Attack Shows
By the standards of major cryptocurrency hacks, the sum looks small, but the story of Sality is important for another reason. It shows how long a simple scheme can work if it exploits user habits: copying, pasting, and not checking the result.
Malware of this type does not necessarily behave like ransomware, a keylogger, spyware, or adware. It may not display a pop-up window, send spam via email, encrypt files on the hard drive, or launch a DoS attack on a website. Its task was quieter and more precise—to wait for the moment when a person copies a wallet address.
The history of malware began with relatively simple viruses and worms, then moved on to trojans, ransomware, spyware, and botnets. Among the most famous and destructive examples are ILOVEYOU, which spread via email, and Mirai (botnet), which infected devices and used them for attacks. Against this background, Sality stood out with a niche tactic: it waited for the moment when a person copied a cryptocurrency wallet address.
To reduce the risk of such attacks, simple habits are important:
- Use antivirus software.
- Regularly update the operating system.
- Carefully check data before sending a cryptocurrency transfer.
Updated antivirus software and operating systems close some vulnerabilities before malware can exploit them.
A separate risk is associated with social engineering and disguising malicious files as regular applications. A user may download infected software from a suspicious website, receive it via a shared drive, or run a file from a USB drive, not realizing the computer has already become part of the attackers’ network.
The operation against Sality was linked to Russia. For the market, this is another reminder: computer security in cryptocurrencies starts not only with choosing a wallet, but also with checking every action before sending funds.
What Malware Is and How It Spreads
Malware is a program or code fragment created for unauthorized access, data theft, surveillance, displaying intrusive ads, blocking files, or including a device in a botnet.
Most often, it gets onto devices via email and attachments, infected websites, suspicious downloads, USB drives, shared network resources, and applications disguised as safe programs.
Main Types and Signs of Infection
- Viruses attach themselves to files or programs and run with them.
- Worms spread over the network and can infect devices without explicit user action.
- Trojans look like regular applications but perform hidden malicious actions.
- Spyware monitors user activity and can collect passwords, correspondence, or other data.
- Adware displays intrusive ads and can redirect the user to suspicious sites.
- Ransomware blocks files or the system and demands a ransom to restore access.
- Rootkits help hide the presence of malware in the system.
- Botnets unite infected devices and use them for attacks, spam, or data theft.
Signs of infection may include noticeable slowdowns, pop-up windows, spontaneous reboots, unusual network activity, the appearance of unknown programs, blocked access to files, and strange behavior of the browser or wallet.
Protection, Antivirus, and Removing Malware
Protection is helped by regular updates of software and the operating system, antivirus, caution with attachments and links, avoiding suspicious downloads, checking USB drives, and backing up important data.
Among popular antivirus programs are Kaspersky, ESET NOD32, Avast, Bitdefender, and Norton. Kaspersky is a Russian product; when choosing antivirus, pay attention to update frequency, protection features, device compatibility, support quality, and scan convenience.
{
“@context”: “https://schema.org”,
“@type”: “Article”,
“about”: [
{
“@type”: “Organization”,
“name”: “CrowdStrike”
},
{
“@type”: “Thing”,
“name”: “malware”
},
{
“@type”: “Thing”,
“name”: “botnet”
},
{
“@type”: “Thing”,
“name”: “cryptocurrency”
},
{
“@type”: “Thing”,
“name”: “computer security”
},
{
“@type”: “Thing”,
“name”: “computer security vulnerability”
},
{
“@type”: “Thing”,
“name”: “antivirus software”
},
{
“@type”: “Thing”,
“name”: “social engineering”
},
{
“@type”: “Place”,
“name”: “Russia”
}
]
}
- Disconnect the device from the network if there are signs of active infection.
- Run a full scan with an antivirus scanner.
- If malware interferes with operation, boot the device in safe mode and repeat the scan.
- Remove detected threats and restart the device.
- Update the operating system, browser, wallet, and other important programs.
- In case of serious damage, use system restore or a clean backup.
