An international law-enforcement and cybersecurity operation has disrupted Sality, a long-running peer-to-peer botnet that authorities say has been used since 2003 to distribute malware, steal cryptocurrency and support other cyberattacks.

The operation, carried out August 31, involved authorities in the United States, Bulgaria, Hungary and Romania, with support from Europol and Eurojust and technical participation from CrowdStrike and the Shadowserver Foundation. The U.S. Justice Department announced the action September 1.

More than 11 million unique IP addresses have been linked to Sality infrastructure over its lifetime. Europol said the botnet at its peak gave its operator access to as many as one million infected machines worldwide. Those figures describe historical reach rather than the number of computers under active control when the disruption occurred.

Sality’s decentralized design made it unusually difficult to disable. Unlike botnets that depend primarily on centralized command-and-control servers, infected Sality machines exchanged commands and information directly with other compromised computers. That architecture removed an obvious central point that authorities could simply seize.

The disruption turned Sality’s peer-to-peer mechanism against the botnet. CrowdStrike said it manipulated the protocol used to maintain lists of trusted peers, causing infected machines to discard legitimate Sality peers and replace them with defender-operated sinkholes. As machines became isolated, instructions for downloading or directly distributing new malicious payloads could no longer propagate through the network.

Authorities simultaneously targeted supporting Internet infrastructure. The Justice Department, FBI and Defense Criminal Investigative Service seized Sality-linked domains in the United States, while European authorities acted against additional domains. The Shadowserver Foundation is working with Internet service providers and computer security incident response teams to identify infected systems, notify affected parties and support remediation.

The action disrupts Sality’s control infrastructure but does not itself remove malware from infected computers. CrowdStrike said more than 15,000 machines were receiving malicious payloads through the network immediately before the operation. Shadowserver’s notification and remediation work is therefore an important second stage: compromised systems can remain infected even after their connection to the botnet operator has been severed.

The operation also illustrates the challenge posed by decentralized botnets. Sality’s peer-to-peer architecture helped it survive for more than two decades without depending on a single command server, requiring investigators and security researchers to intervene at the protocol and infrastructure levels rather than rely on a conventional server seizure.