A P2P botnet thought to have been running for over two decades, has suffered significant disruption thanks to a US-led law enforcement operation.

Carried out on August 31, the operation against the Sality botnet brought together authorities from Bulgaria, Hungary, Romania, and the US, with the support of Europol as well as private-sector partners CrowdStrike and the Shadowserver Foundation.

A big part of the disruption activity focused on “sinkholing” – the process of redirecting communications from infected machines away from the botnet infrastructure.

This was necessary because of the way that P2P botnets operate: machines communicate with each other in a decentralized fashion rather than with a single command and control (C2) server, making the infrastructure harder to disrupt.

Read more on P2P botnets: Novel Worm-Like Malware P2Pinfect Targets Redis Deployments.

Europol said the operation had been a long time coming. It has supported efforts to identify and take down infrastructure linked to Sality around the world since 2017.

“In the weeks leading up to the latest disruption, this cooperation intensified, with partners holding weekly operational calls to coordinate their actions,” the policing organization continued. “Europol supported the involvement of law enforcement authorities in Bulgaria, Hungary and Romania, helping to coordinate measures against the botnet infrastructure across the different jurisdictions.”

While authorities in the US and Europe focused on seizing Sality-linked domains, the Shadowserver Foundation coordinated with ISPs and Computer Security Incident Response Teams (CSIRTs) to identify infections, notify victims, and help with remediation, the US Justice Department said.

20 Years and Counting

According to Europol, Sality has been operating for more than 20 years, and at its peak featured over one million infected machines unwittingly conscripted into criminal efforts to distribute malicious payloads for crypto-theft and other attacks.

Over the course of the past two decades, more than 11 million unique IP addresses have been linked to the infrastructure, it added.

CrowdStrike claimed the botnet enabled its operator to distribute malicious payloads to over 15,000 infected machines. These spanned credential theft, spam distribution, proxy services, network exploitation and DDoS attacks, it said.

Exposing Sality's Trust Flaw

The security vendor explained that the operation to disrupt Sality leveraged the fact that machines trust the network without verifying who is in it.

“Every Sality bot maintains a finite list of known super peers, which are publicly reachable infected machines that form the backbone of the P2P network,” it continued. “Every 40 minutes, it verifies whether its stored peers are still online. Peers that respond accumulate reputation; those that fail to respond lose reputation and are eventually purged.”

The disruption took advantage of this to:

• Remove legitimate peers via protocol-level manipulation during peer verification
• Insert sinkhole entries into the emptied peer lists to enable progress tracking and victim notification