At its peak Sality gave access to up to one million infected machines
Assessment
Europol states this without a date or method. The likely basis is Symantec's July 2011 measurement that a rogue peer on the V3 network "communicates with more than a million unique IP addresses" per day, which Symantec itself qualified as "potentially a million peers". Unique IP addresses over-count machines on dynamic addressing and under-count machines sharing a NAT gateway, so the figure is a defensible order of magnitude for 2011 rather than a count of machines at any moment.
Where this claim appeared
Europol · 2026-09-02
https://www.europol.europa.eu/media-press/newsroom/news/global-public-private-operation-disrupts-sality-botnet-active-for-two-decadesWhat “Assessed, Not Confirmed” means
A named source states this as its own assessment, at its own stated confidence, rather than as established fact. Attribution to a nation state usually sits here. The assessment is real and reportable; treating it as settled is the error.
4 of 5 · rating scale
Assessed in
Sality Botnet Takedown: How a 23-Year-Old P2P Network Was Turned Against ItselfThink this assessment is wrong? Report an error.