Sality has been active since 2003

Assessment

Two independent primary sources agree. Symantec's July 2011 whitepaper, written from sample analysis, states "The first public occurrence of Sality was recorded in June 2003" and describes those early versions in detail, including the strings that gave the malware its name. The Department of Justice release of 1 September 2026 states "Since 2003, the Sality botnet has installed malicious software on compromised devices." CrowdStrike and Europol give the same start year. The twenty-three-year figure in headlines follows directly.