The Aug. 31 disruption of the Sality botnet cut its operator off from delivering new malicious software to more than 33,000 infected computers worldwide, CrowdStrike said in a Sept. 1 report. The operation changed the peer lists used by infected machines, isolated them from the operator and redirected communications to defender-controlled sinkholes (servers that capture malicious traffic). It also removed URLs hosting payloads and involved U.S. authorities seizing Sality-linked domains, with partners in Bulgaria, Hungary and Romania targeting additional domains. The action did not remove malware already installed on devices. CrowdStrike identified EggJagger as Sality's main payload during the preceding eight years; the tool monitors copied cryptocurrency addresses and replaces them with addresses controlled by the operator. A payment is redirected only if a user sends funds to the substituted destination. The number of users who lost cryptocurrency remains unspecified. CrowdStrike recommends that network operators review logs and device telemetry for UDP traffic to 188.166.101[.]148 and use its YARA detection rules (pattern-based malware rules) to scan running processes. The Justice Department said the Shadowserver Foundation is working with internet service providers and computer security incident response teams to identify infections, notify affected users and support remediation.