ThreatPaper
Superseded

Sality botnet had over 15,000 infected machines at disruption

Assessment

CrowdStrike's write-up carried "over 15,000 infected machines" when published on 1 September 2026 and in Internet Archive snapshots of 2 and 3 September. From the 4 September snapshot the same sentence reads "over 33,000". A diff of the two archived versions shows this is the only substantive change, and no correction note was added. BleepingComputer, The Hacker News, Help Net Security and SecurityWeek all reported 15,000, citing CrowdStrike, and continue to. The figure was accurate as a quotation of the source at the time; the source has since more than doubled it without explanation.

Where this claim appeared

Crowdstrike · 2026-09-01

https://www.crowdstrike.com/en-us/blog/inside-sality-botnet-disruption-operation/

What “Superseded” means

Reported accurately at the time, then corrected by the original source. Recorded because the original version usually continues circulating long after the correction.

2 of 5 · rating scale

Assessed in

Sality Botnet Takedown: How a 23-Year-Old P2P Network Was Turned Against Itself

Think this assessment is wrong? Report an error.