Clipboard Malware Still Threatens Crypto Payments After Sality Botnet Takedown

A multinational operation that disrupted the Sality botnet on 31 August has cut its operator off from infected computers, but malware already installed on those machines, including a tool that diverts cryptocurrency payments, is still running.

CrowdStrike, which published a report on the action on 1 September, said the botnet had been used to deliver payloads to more than 33,000 infected machines worldwide. As CryptoSlate noted, that figure counts compromised computers rather than victims; how many users actually lost cryptocurrency has not been disclosed.

The takedown

The Justice Department announced the operation on 1 September, the day after it took place. US authorities seized domains linked to Sality, while partners in Bulgaria, Hungary and Romania moved against additional domains.

Infected Sality machines locate one another through peer lists. The operation altered those lists, isolating infected computers from the operator and inserting sinkholes controlled by defenders. Partners also took down URLs that had been hosting malicious payloads.

Sality is a file infector, meaning it attaches itself to executable programs. It spreads through network shares, removable drives and file sharing, which helps explain how it has persisted for so long.

How the address swap works

CrowdStrike identified EggJagger as Sality's main payload over the past eight years. It watches the clipboard for cryptocurrency addresses, including Bitcoin and Ethereum addresses, and quietly replaces them with addresses controlled by the operator.

The attack exploits a routine habit. Crypto addresses are long strings of characters, so almost everyone copies and pastes them rather than typing them out. A user on an infected machine can copy the correct recipient's address, paste it into a payment form and end up with a different destination.

Nothing is lost at the moment of the swap. The damage happens only if the user then sends funds to the substituted address. Because blockchain transfers generally cannot be reversed, a payment sent to the wrong address is usually gone for good.

Why the clean-up is incomplete

The disruption removes the operator's ability to push new software to infected machines. It does not remove what is already there. Address-swapping software installed before 31 August can keep working after Sality's communications have been cut, so anyone with a confirmed infection still needs to have the malware removed.

This is a common limitation of botnet takedowns. They sever the command channel, but cleaning individual machines depends on owners finding out they are infected, and many will not know.

According to the Justice Department, the Shadowserver Foundation is collaborating with internet providers and incident response teams for computer security to track down infected devices and alert the people affected.

What users and defenders can do

CrowdStrike advises organisations to check network logs and device telemetry for UDP traffic to a so-called lighthouse address, 188.166.101[.]148. Any match indicates an infection that needs remediation. Its technical report also includes YARA rules that can be used to scan running processes.

For individuals, the simplest precaution is to compare the full pasted address against the intended one before confirming a payment, rather than checking only the first and last few characters. Acting promptly on any infection notice from an internet provider also matters, since the swap itself is designed to go unnoticed.

Still to be seen is how many machines are cleaned, and whether a clearer picture emerges of how much cryptocurrency EggJagger diverted during its eight years in use.