The Sality operator is likely based in Bashkortostan, Russia
Assessment
CrowdStrike states this as a "likely" assessment for the actor it names SALTY SPIDER. The only published basis is old: Symantec's 2011 whitepaper records that the name "Sality" derives from "Salavat City, a Russian town from which the author may originate", and Salavat is in Bashkortostan. CrowdStrike may hold additional evidence, but has not described any. No law enforcement body has attributed the botnet to a person or location, and nobody has been charged. Press coverage has repeated the location as fact.
Where this claim appeared
Crowdstrike · 2026-09-01
https://www.crowdstrike.com/en-us/blog/inside-sality-botnet-disruption-operation/What “Assessed, Not Confirmed” means
A named source states this as its own assessment, at its own stated confidence, rather than as established fact. Attribution to a nation state usually sits here. The assessment is real and reportable; treating it as settled is the error.
4 of 5 · rating scale
Assessed in
Sality Botnet Takedown: How a 23-Year-Old P2P Network Was Turned Against ItselfThink this assessment is wrong? Report an error.