Russian malicious software operation dismantled, feds in LA say

LOS ANGELES (KESQ) - Federal prosecutors in Los Angeles today announced a multinational operation to dismantle the resilient Russian botnet and malware ecosystem Sality, which is known for enabling cryptocurrency theft and cyberattacks on victims in the United States and abroad.

As part of the effort, the U.S. Department of Justice, FBI and Defense Criminal Investigative Service seized Sality-linked domains in the United States, while international law enforcement partners in Bulgaria, Hungary and Romania took action against additional Sality-linked domains hosted in Europe.

Federal law enforcement worked with the private sector to identify and disrupt malicious networks and disrupt their tools and infrastructure, the U.S. Attorney's Office said.

"Cybercriminals, botnets and malware are a clear and present danger to our nation's security and economy,'' First Assistant U.S. Attorney Bill Essayli said. "This successful effort to take down the Sality botnet shows that by working together the public and private sectors can be a powerful force for good.''  

Victim computers infected with Sality were part of a peer-to-peer botnet, which is a network of computers infected with the Sality malware and controlled by the Sality operator. A P2P botnet is a decentralized network of bots that communicate directly with each other to share commands. The owners of the victim computers were typically unaware that their devices had been misappropriated as bots by Sality, authorities said.   

Officials said the Sality botnet has installed malicious software on compromised devices throughout the world for the past 23 years.   

"This unique collaboration among international law enforcement and private sector partners only enhances the FBI's cyber security capabilities and our efforts to neutralize the threat posed by the Sality botnet,'' said Patrick Grandy, assistant director in charge of the FBI's Los Angeles bureau. ``The FBI will continue working with our partners to prevent further cyber-enabled attacks and theft from victims in the United States."