The Justice Department and CrowdStrike announced on Tuesday that they had disrupted Sality, a peer-to-peer botnet that has been running since 2003. ^[1] CrowdStrike estimates that the Sality operator stole at least $150,000 through its primary payload, EggJagger, over the past eight years. ^[2] CrowdStrike values the unspent stolen cryptocurrency portfolio at a peak of about 147 million rubles in January 2025, which is roughly the purchasing power of $4 million in a Western capital. ^[3] The EggJagger payload monitors the clipboard for cryptocurrency wallet addresses and swaps them for the operator's own addresses, causing victims to send funds to strangers. ^[4] The EggJagger tool monitored a victim's clipboard for cryptocurrency wallet addresses and silently replaced them with addresses controlled by the operator, allowing funds to be redirected before a payment was completed. ^[5] The Sality botnet has been active since 2003 and evolved into a peer-to-peer network where infected machines communicate directly with one another rather than relying on a central command-and-control server. ^[6]