US and CrowdStrike Dismantle 20-Year-Old Russian Cybercrime Operation Sality
Operation Sality: Takedown of a Notorious Russian Botnet
Background and Announcement
LAS VEGAS, Sept 1 (Reuters) - A two-decade-old Russian hacking operation dubbed "Sality" is being dismantled, U.S. law enforcement officials and cybersecurity company CrowdStrike announced on Tuesday.
U.S. officials said they had seized the web domains hackers used to take over computers to send spam, carry out distributed denial-of-service operations or steal cryptocurrency, while CrowdStrike said it had cut off a network of compromised computers from the mastermind controlling it.
Live Dismantling and Law Enforcement Coordination
CrowdStrike began dismantling the "botnet" on Monday in front of a live audience at the company’s Day Zero threat intelligence summit in Las Vegas.
The FBI and U.S. Justice Department said in a pair of statements issued on Tuesday that the operation had been carried out in coordination with European law enforcement and other organizations.
Official Statements and Significance
"Cybercriminals, botnets, and malware are a clear and present danger to our nation’s security and economy,” First Assistant United States Attorney Bill Essayli said in a statement announcing the move.
History and Resilience of Sality
Although it has in recent years been overshadowed by more disruptive ransom-seeking cybercriminals, Sality, first spotted in 2003, remains one of the internet’s longest-running cybercriminal enterprises.
The Justice Department said it was based out of Russia but did not provide further detail. The Russian Embassy in Washington did not immediately respond to a request for comment.
Technical Architecture and Challenges
Sality's peer-to-peer architecture meant it could receive commands through a diffuse network of compromised machines, making it particularly resistant to law enforcement action.
CrowdStrike’s Countermeasures
But CrowdStrike said in a blog post published on Tuesday that it turned that strength against Sality by seeding the network with bogus information that tricked the botnet's components into cutting themselves off from their creator.
CrowdStrike researcher Tillmann Werner said that reverse-engineering the botnet's structure, finding weak points and building the infrastructure needed to knock it down had required painstaking work.
"This was the most complex botnet takeover we have ever done," Werner told Reuters. "This was built to be resilient. It was built to survive takedown or takeover. I think that's the reason it's been around for so long."
Ongoing Risks and Future Outlook
David Watson, director of nonprofit security group The Shadowserver Foundation, which was also involved in the takedown, said Sality was "quite old-school" but could still be dangerous.
“It's still a vector into a lot of organizations,” Watson said.
He said the next step would be to see what, if anything, Sality's creator, who has yet to be publicly identified, did to regain control of or re-create the botnet.
“What does he do?” Watson said. “Does he fight back?”
Reporting Credits
(Reporting by Raphael Satter in Las Vegas; Additional reporting by Anton Zverev in London; Editing by Jamie Freed)