Authorities Turn Sality's P2P Network Against Itself, Cutting Off New Malware Payloads

The U.S. Department of Justice (DoJ) on Tuesday announced the takedown of a long-standing peer-to-peer (P2P) botnet known as Sality as part of a coordinated law enforcement operation. The effort was undertaken on August 31, 2026, by authorities from the U.S., Bulgaria, Hungary, and Romania, in collaboration with private industry partners CrowdStrike and the Shadowserver Foundation. To that

Fact: Authorities from the U.S., Bulgaria, Hungary, and Romania, in coordination with private partners like CrowdStrike and Shadowserver, disrupted the Sality peer-to-peer botnet infrastructure, blocking new malware payload distribution through that network. Fact: The operation represents a law-enforcement-led takedown of a long-standing distributed malware delivery ecosystem, reducing immediate risk from that specific botnet. RealGround analysis: While Sality itself is a traditional botnet, similar P2P infrastructures can be repurposed to distribute AI-powered malware or coordinate compromised AI agents at scale. Organizations should treat this as a reminder to include botnet and P2P infrastructure abuse scenarios in their AI threat models and continuously red team how AI-enabled tooling might be leveraged or targeted within such ecosystems.