# Europol-backed operation targets Sality botnet infrastructure

> Europol said an international action on 31 August targeted Sality botnet infrastructure linked to more than 11 million unique IP addresses.

- Canonical URL: https://newsverum.com/en/news/europol-sality-botnet-disruption-september-2026
- Publisher: Newsverum
- Section: Security
- Published: 2026-10-06T08:59:00+00:00
- Updated: 2026-10-07T05:57:35+03:00
- Event / data period: 2026-08-31
- Other editions: [Türkçe](https://newsverum.com/tr/news/europol-sality-botnet-disruption-september-2026.md), [العربية](https://newsverum.com/ar/news/europol-sality-botnet-disruption-september-2026.md), [Français](https://newsverum.com/fr/news/europol-sality-botnet-disruption-september-2026.md), [Español](https://newsverum.com/es/news/europol-sality-botnet-disruption-september-2026.md), [Deutsch](https://newsverum.com/de/news/europol-sality-botnet-disruption-september-2026.md), [Português](https://newsverum.com/pt/news/europol-sality-botnet-disruption-september-2026.md)

Europol announced on 2 September 2026 a coordinated action led by US authorities with Bulgaria, Hungary and Romania. It said the Sality peer-to-peer botnet had been used for years to distribute malicious payloads and that more than 11 million unique IP addresses had been linked to its infrastructure.

At its peak, the botnet was believed to have given its operator access to as many as one million infected machines worldwide, according to Europol. The European Cybercrime Centre supported intelligence sharing and operational meetings; the reported IP-address total does not represent a count of infected devices.

## Data

### Security development

Security event or institutional action reported by the source.

Methodology: The event date and description summarise the action reported by the source; no additional measurement or forecast is made.

| date | label | description | status |
|---|---|---|---|
| 2026-08-31 | Coordinated action against the Sality botnet | The US-led action targeted the botnet infrastructure with Bulgaria, Hungary and Romania. Europol said more than 11 million unique IP addresses had been linked to the infrastructure. | occurred |

Sources: <https://www.europol.europa.eu/media-press/newsroom/news/global-public-private-operation-disrupts-sality-botnet-active-for-two-decades> · Download data: [JSON](https://newsverum.com/api/v1/articles/europol-sality-botnet-disruption-september-2026/data/security-event?lang=en&format=json) · [CSV](https://newsverum.com/api/v1/articles/europol-sality-botnet-disruption-september-2026/data/security-event?lang=en&format=csv)

### Measure reported by the source

Key quantitative figure stated by the source.

Methodology: Value is reproduced as stated by the source; a qualifier marks an approximate or bounded figure.

| label | value | unit | period | basis | value_qualifier |
|---|---|---|---|---|---|
| Unique IP addresses linked to infrastructure | 11000000 | count | 2026-08-31 | observed | lower-bound |

Sources: <https://www.europol.europa.eu/media-press/newsroom/news/global-public-private-operation-disrupts-sality-botnet-active-for-two-decades> · Download data: [JSON](https://newsverum.com/api/v1/articles/europol-sality-botnet-disruption-september-2026/data/security-figures?lang=en&format=json) · [CSV](https://newsverum.com/api/v1/articles/europol-sality-botnet-disruption-september-2026/data/security-figures?lang=en&format=csv)

## Sources

- [Europol](<https://www.europol.europa.eu/media-press/newsroom/news/global-public-private-operation-disrupts-sality-botnet-active-for-two-decades>) (Source checked: 2026-10-06; Published: 2026-09-02)

## Correction history

- 2026-10-07T00:51:22+03:00: German and Portuguese editions and translations of the data and correction explanations have been added to this article.
- 2026-10-07T05:57:35+03:00: Data classification added: each figure now carries a measure identifier with its unit, geography, frequency and type. No figure, unit or date changed.

---

Cite the canonical URL above. [Editorial standards and corrections](https://newsverum.com/en/editorial)