Sality botnet dismantled: 11 million IP addresses affected, Hungary participated
In an internationally coordinated operation, the Sality botnet—a network active for over two decades built from infected computers—has been disabled. The botnet was connected to 11 million unique IP addresses. Hungarian cybersecurity experts participated in the operation.
Hungarian cybercrime prevention unit participated in Sality botnet shutdown
According to a police.hu report, on 31 August an internationally coordinated operation disabled the Sality botnet, a network active for over two decades comprised of infected computers. Based on Europol data, over 11 million unique IP addresses connected to the botnet infrastructure over the years; at its peak it could have provided access to as many as one million infected devices.
Computers infected with the Sality malware could be used to distribute further malicious programmes, steal data and carry out cyberattacks. Dismantling the network was also complicated by the fact that it was not controlled by a single central server: the infected devices communicated directly with each other.
The operation was led by the United States, in which Europol, Eurojust, and the cybercrime prevention units of Bulgaria, Romania and Hungary participated. From the private sector, CrowdStrike and the Shadowserver Foundation collaborated. During preparation, the Sality infrastructure was jointly mapped out, collected information was shared amongst themselves, and measures to be implemented in individual countries were coordinated.
On behalf of Hungary, the Cyber Crime Prevention Department of the National Investigation Office of the Emergency Services (KR NNI) participated in the operation. The department's measures contributed to disrupting the infrastructure necessary for the botnet's operation and ultimately rendering it inoperative. The KR NNI Cyber Crime Prevention Department is in direct contact with Europol and numerous foreign counterpart authorities, through which continuous information exchange and cooperation takes place.
The action against Sality formed part of international cooperation realised within the EMPACT framework, which aims to have law enforcement agencies and private sector experts from various countries jointly dismantle cybercriminal infrastructure that simultaneously affects millions of devices and numerous countries.
Source: Google News HU — Crime (hu)