A global operation backed by Europol has disrupted the Sality botnet, a network of infected computers used for years to spread malicious software to devices around the world.
The coordinated action took place on 31 August 2026 and was led by US authorities, Europol announced on Wednesday.
Sality is a peer-to-peer botnet — meaning infected machines communicate directly with each other rather than relying on a single central server.
At its peak, the botnet gave its operator access to as many as one million infected machines worldwide.
More than 11 million unique IP addresses have been linked to Sality’s infrastructure to date.
Authorities in Bulgaria, Hungary, Romania and the United States took part, supported by Europol and private-sector partners CrowdStrike and the Shadowserver Foundation.
As part of the disruption, investigators carried out a “sinkholing” operation, which redirects traffic from infected computers away from criminal systems.
The step isolated compromised devices from the botnet and made the operator’s command channel inoperable.
How the takedown worked
Peer-to-peer botnets are typically harder to dismantle than systems controlled by a traditional command-and-control server because there is no single central point to shut down, Europol said.
Work against Sality has involved international cooperation over several years, with Europol supporting efforts since 2017 to identify and remove infrastructure linked to the botnet as it was found in different jurisdictions.
In the weeks before the latest action, partners held weekly operational calls to coordinate their steps, while Europol helped coordinate measures involving law enforcement in Bulgaria, Hungary and Romania.
Europol’s European Cybercrime Centre supported the exchange and analysis of cyber intelligence during the operation, and the agency worked alongside Eurojust, the EU body that supports judicial cooperation.
