Sality botnet had over 15,000 infected machines at disruption
Assessment
CrowdStrike's write-up carried "over 15,000 infected machines" when published on 1 September 2026 and in Internet Archive snapshots of 2 and 3 September. From the 4 September snapshot the same sentence reads "over 33,000". A diff of the two archived versions shows this is the only substantive change, and no correction note was added. BleepingComputer, The Hacker News, Help Net Security and SecurityWeek all reported 15,000, citing CrowdStrike, and continue to. The figure was accurate as a quotation of the source at the time; the source has since more than doubled it without explanation.
Where this claim appeared
Crowdstrike · 2026-09-01
https://www.crowdstrike.com/en-us/blog/inside-sality-botnet-disruption-operation/What “Superseded” means
Reported accurately at the time, then corrected by the original source. Recorded because the original version usually continues circulating long after the correction.
2 of 5 · rating scale
Assessed in
Sality Botnet Takedown: How a 23-Year-Old P2P Network Was Turned Against ItselfThink this assessment is wrong? Report an error.