5 minhigh
Peer Pressure: Inside the Sality Botnet Disruption Operation
CrowdStrike disrupted the Sality botnet by manipulating its P2P protocol. The operation removed legitimate super peers from bot peer lists and inserted sinkhole entries. This action isolated infected machines from the operator. Defenders can identify infected machines by monitoring UDP traffic to a lighthouse IP address and using provided YARA rules.
Sens:■ ImmediateConf:high
Showing defanged values
- domainforex2030[.]comTarget of a DDoS attack by the Sality botnet in April 2016.
- domainkharkovforum[.]comTarget of a DDoS attack by the Sality botnet in February 2022.
- ip188[.]166[.]101[.]148CrowdStrike-operated sinkhole lighthouse IP address. Any UDP traffic to this IP indicates an active Sality infection.
- urlhxxp://gatheredovertime[.]com/nb4Sality v4 URL pack version 31010 distributed before disruption. Access attempts indicate infection.
- urlhxxp://highclass[.]atspace[.]com/styles[.]gifLast URL pack distributed before disruption. Access attempts indicate infection.
- urlhxxp://imagebucket[.]biz/nv4Sality v4 URL pack version 31010 distributed before disruption. Access attempts indicate infection.
- urlhxxp://painelwebradiodigital[.]awardspace[.]info/v3/readme[.]pdfLast URL pack distributed before disruption. Access attempts indicate infection.
- urlhxxp://pozdravizbeograda[.]com/readme[.]pdfLast URL pack distributed before disruption. Access attempts indicate infection.
- urlhxxp://sgwebdesigner[.]free[.]fr/left[.]gifLast URL pack distributed before disruption. Access attempts indicate infection.
- urlhxxp://situluimihai[.]3x[.]ro/top[.]pngLast URL pack distributed before disruption. Access attempts indicate infection.
- urlhxxp://theunforgiven[.]p8[.]hu/img/top[.]gifLast URL pack distributed before disruption. Access attempts indicate infection.
- urlhxxp://www[.]yonelco[.]com/icon[.]pngLast URL pack distributed before disruption. Access attempts indicate infection.
Detection / Hunteropenrouter
What Happened
CrowdStrike disrupted the Sality botnet. This botnet is a network of compromised computers operating for over 20 years. The operator used the network to steal cryptocurrency and launch denial-of-service attacks. CrowdStrike manipulated the botnet's communication system to cut off the operator's control. Organizations should check their networks for specific indicators provided by CrowdStrike to find and clean infected systems.
Key Takeaways
- CrowdStrike disrupted the Sality botnet by manipulating its P2P architecture and sinkholing infected machines.
- The operator used the botnet for financial gain through cryptocurrency theft and occasional DDoS attacks for personal or political reasons.
- The disruption involved invalidating legitimate super peers in the botnet's peer list and inserting sinkhole entries.
- Infected machines now beacon to a CrowdStrike-operated lighthouse IP address, which defenders can use for identification.
- YARA rules are provided to detect active Sality infections by scanning running processes for hardcoded RSA public keys.
Affected Systems
- Windows endpoints infected with Sality
- Machines behind firewalls or NAT with Sality infections
Vulnerabilities (CVEs)
None identified.
Attack Chain
- Initial Access: Sality propagated as a file infector, attaching itself to executables on disk.
- C2 & P2P: Infected machines maintained a peer list of super peers, communicating over a P2P protocol every 40 minutes.
- Payload Delivery: The botnet distributed URL packs and file packs containing payloads like EggJagger or DDoS scripts.
- Disruption: CrowdStrike manipulated the P2P protocol to invalidate legitimate super peers and insert sinkhole entries.
- Isolation: Bots were forced to beacon to CrowdStrike sinkholes, cutting off operator communication and halting payload distribution.
Detection Availability
- YARA Rules: Yes
- Sigma Rules: No
- Snort/Suricata Rules: No
- KQL Queries: No
- Splunk SPL Queries: No
- EQL Queries: No
- Other Detection Logic: No
- Platforms: CrowdStrike blog post
The article provides YARA rules for memory scanning to detect Sality v3 and v4 infections by looking for hardcoded RSA public keys. It also provides a lighthouse IP address and URLs for network-based detection.
Detection Engineering Assessment
copy:
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | High | EDR can detect Sality infections by scanning running processes for hardcoded RSA public keys using the provided YARA rules. |
| Network Visibility | High | Network logs can identify infected machines by monitoring for UDP traffic to the lighthouse IP address and attempts to access the provided payload URLs. |
| Detection Difficulty | Easy | Detection relies on beaconing to a known lighthouse IP and YARA rules for memory scanning. Both are straightforward to implement. |
Required Log Sources
- Network firewall logs
- DNS logs
- Endpoint process memory scans
- Proxy logs
Hunting Hypotheses
copy:
| Hypothesis | Telemetry | ATT&CK Stage | FP Risk |
|---|---|---|---|
| Consider hunting for endpoint processes with memory regions containing the specific Sality RSA public keys referenced by the YARA rules. This indicates an active infection. | Endpoint Detection and Response (EDR) process memory scans | Execution | Low |
| Consider hunting for outbound UDP traffic to the lighthouse IP address. This indicates a bot attempting to contact the sinkhole. | Network firewall logs, NetFlow data | Command and Control | Low |
| Consider hunting for HTTP requests to known Sality payload URLs. This indicates an infected machine attempting to download new payloads. | Proxy logs, DNS logs | Command and Control | Medium |
Control Gaps
- Lack of network segmentation allowing P2P traffic outbound
- Endpoints missing memory scanning capabilities for YARA rule execution
Key Behavioral Indicators
- UDP traffic to 188.166.101.148
- HTTP requests to theunforgiven.p8.hu
- Process memory containing 'IPFILTERDRIVER' string
False Positive Assessment
Low
Recommendations
Immediate Mitigation
defender takeaway
- Verify against your organization's incident response runbook and team escalation paths before acting.
- Review network logs for UDP traffic to the lighthouse IP address to identify infected machines.
- Run the provided YARA rules against process memory on endpoints to detect active Sality infections.
- Block the listed payload URLs at the firewall or proxy to prevent payload downloads.
Infrastructure Hardening
- Consider blocking outbound P2P traffic to prevent botnet communication.
- Evaluate whether network segmentation can restrict peer-to-peer communication paths for endpoints.
User Protection
- Ensure endpoint protection platforms are enabled and updated to detect file infectors.
- Consider isolating infected machines from the network until remediation is complete.
Security Awareness
- Remind users to avoid executing unknown or untrusted files, as Sality spreads by infecting executables.
MITRE ATT&CK Mapping
MITRE ATT&CK Mapping4 techniques
Tactic
Command and Control
Tactic
Impact
Additional IOCs
- Domains:
forex2030[.]com- Target of a DDoS attack by the Sality botnet in April 2016.kharkovforum[.]com- Target of a DDoS attack by the Sality botnet in February 2022.
![hxxp://highclass[.]atspace[.]com/styles[.]gif](/iocs/url/http%3A%2F%2Fhighclass.atspace.com%2Fstyles.gif){kind=link}
![hxxp://sgwebdesigner[.]free[.]fr/left[.]gif](/iocs/url/http%3A%2F%2Fsgwebdesigner.free.fr%2Fleft.gif){kind=link}
![hxxp://situluimihai[.]3x[.]ro/top[.]png](/iocs/url/http%3A%2F%2Fsituluimihai.3x.ro%2Ftop.png){kind=link}
![hxxp://theunforgiven[.]p8[.]hu/img/top[.]gif](/iocs/url/http%3A%2F%2Ftheunforgiven.p8.hu%2Fimg%2Ftop.gif){kind=link}
![hxxp://www[.]yonelco[.]com/icon[.]png](/iocs/url/http%3A%2F%2Fwww.yonelco.com%2Ficon.png){kind=link}