SALTY SPIDER is the developer behind the Sality botnet, known for stealing cryptocurrency since 2018.
SALTY SPIDER is a threat actor observed since January 2018, known as the developer and operator behind the long-running Sality botnet. This actor specifically targets cryptocurrency users by distributing malware designed to steal their digital assets. Their primary TTP involves leveraging the existing Sality botnet infrastructure to propagate custom cryptocurrency-stealing malware. Defenders should focus on monitoring network traffic associated with the botnet, suspicious download activities, and information-stealing attempts aimed at cryptocurrency wallets.
Beginning in January 2018 and persisting through the first half of the year, CrowdStrike Intelligence observed SALTY SPIDER, developer and operator of the long-running Sality botnet, distribute malware designed to target cryptocurrency users.
SALTY SPIDER specifically targets cryptocurrency users.
It uses the Sality botnet infrastructure.
Every claim on this page is drawn from the cited source (MISP Galaxy, MITRE ATT&CK, ransomware.live) — no attribution is invented.