A multinational disruption of Sality shows how peer-to-peer malware can be weakened when defenders understand the protocol well enough to interfere with its trust layer.