EggJagger stole at least ₽12.1 million (about $150,000) in cryptocurrency
Assessment
CrowdStrike presents this as its own estimate and limits it explicitly to the EggJagger clipboard-hijacking payload, excluding every other family Sality distributed. The method is not described; the natural approach is tracing the operator-controlled substitute addresses on-chain, which would make the figure a floor. CrowdStrike also states the operator's unspent holdings peaked at about ₽147 million in January 2025, a valuation of the same funds rather than additional theft. Some coverage has run the two figures together.
Where this claim appeared
Crowdstrike · 2026-09-01
https://www.crowdstrike.com/en-us/blog/inside-sality-botnet-disruption-operation/What “Assessed, Not Confirmed” means
A named source states this as its own assessment, at its own stated confidence, rather than as established fact. Attribution to a nation state usually sits here. The assessment is real and reportable; treating it as settled is the error.
4 of 5 · rating scale
Assessed in
Sality Botnet Takedown: How a 23-Year-Old P2P Network Was Turned Against ItselfThink this assessment is wrong? Report an error.