Peer Pressure: Inside the Sality Botnet Disruption Operation

MITRE Techniques

• [T1105] Ingress Tool Transfer – Sality distributed additional payloads and URL packs to infected machines, enabling new malicious content to be fetched and executed (‘payload download instructions’ and ‘direct payload transfers’).
• [T1027] Obfuscated Files or Information – The malware used polymorphic file infection and compiled payloads that changed to evade static detection (‘Sality was a polymorphic file infector’).
• [T1489] Service Stop – The disruption operation isolated infected peers and prevented them from receiving further tasking, effectively stopping botnet communication (‘rendering the botnet unable to carry out new tasking’).
• [T1095] Non-Application Layer Protocol – Sality used a P2P protocol and UDP beaconing to maintain botnet communications (‘peer-to-peer resilience’ and ‘Any UDP traffic to the lighthouse IP address’).
• [T1132] Data Encoding – The botnet used cryptographic keys and protocol handshakes to validate peers and payload signatures (‘hardcoded RSA public keys’ and ‘verify payload signatures’).
• [T1195] Supply Chain Compromise – Sality attached itself to executable files and spread through network shares, removable drives, and file sharing (‘It attached itself to executable files on infected systems’).
• [T1041] Exfiltration Over C2 Channel – EggJagger monitored clipboard data and redirected cryptocurrency payments to attacker-controlled addresses (‘silently replaces them with addresses controlled by the operator’).
• [T1498] Network Denial of Service – Sality launched DDoS payloads that flooded targeted sites with HTTP traffic to make them unavailable (‘massive HTTP traffic to overwhelm the forum’).
• [T1595] Active Scanning – CrowdStrike and defenders were instructed to scan running processes and network logs for signs of infection (‘scan running processes with the provided YARA rules’).