CrowdStrike talked a 23-year-old botnet into disconnecting itself

The machine at the centre of this story is one nobody logs into. It sits in a plant room or a back office, running an executable that was infected some time in an earlier decade, and this week it quietly stopped talking to its controller because CrowdStrike convinced it there was no controller left to talk to ^[4]. Nothing fired an alert, and nothing was cleaned: the host still carries whatever weakness let Sality on in the first place ^[14].

A domain seizure only reaches the parts of an operation that have addresses ^[8], and Sality deliberately had few of them, spreading through infected executables and keeping compromised hosts pointed at each other ^[7]. So the attack ran against trust in a peer list rather than against cryptography. CrowdStrike's Tillmann Werner called it "the most complex botnet takeover we have ever done" ^[5], announced at the company's Day Zero threat intelligence summit in Las Vegas ^[6], per The Next Web's account of the operation, which cited Reuters reporting ^[2].

A 23-year-old crime platform used for spam, DDoS and cryptocurrency theft was retired this week ^[3][21]. What the operation actually demonstrated is narrower and more durable: a distributed network can be dismantled by persuading its nodes that the controller they trust is gone, no encryption broken and no brute force required ^[20]. A private company did that inside a criminal network, at a moment when the US has authorised private firms to run cyber operations abroad ^[12].

Takedowns get scored in domains seized and superlatives at summits. The two numbers a defender would use are the count of infected machines and the losses, and neither was disclosed ^[13][1]. Shadowserver's David Watson described Sality as a way into a large number of organisations ^[10], which is a statement about value rather than size, and the source of the botnet's worth was the access it sold onward rather than anything it did itself ^[21]. No arrests have been announced, and when operators sit outside the reach of the courts doing the work, seizing infrastructure and cutting connections are among the few moves available ^[11][19].

For the person who has to answer for the unpatched estate on Friday, split the inventory twice: can this machine be patched, and would you notice within a week if it went silent. Patchable and monitored is ordinary operations. Patchable and unmonitored is exactly where Sality lived, because infections persist when nobody notices, nobody patches, or the software keeps running on a system its owner rarely thinks about ^[17]. Unpatchable and monitored is a compensating-controls problem you have already argued about in a meeting. Unpatchable and unmonitored is a machine you cannot make any statement about at all.

The cell to work is that last one, and moving a box into "monitored" is usually cheaper than patching it. Lasting 23 years took less sophistication than it took staying unnoticed ^[18]. The signal this week was a host that went quiet, and only the second question in that grid would have caught it.