U.S. and European authorities announced the disruption of Sality, one of the internet’s longest-running botnets, after turning the malware’s peer-to-peer architecture against itself to cut thousands of infected computers off from the suspected Russian operators controlling the network.

Active since at least 2003, the botnet was disrupted Monday in an operation involving authorities in the U.S., Bulgaria, Hungary and Romania, alongside cybersecurity company CrowdStrike and the nonprofit Shadowserver Foundation.

The U.S. Justice Department announced the operation Tuesday, crediting Crowdstrike and partners with executing “a peer-to-peer sinkhole operation.” Sinkholing refers to the practice of redirecting infected computers away from the criminals’ servers toward infrastructure controlled by cybersecurity defenders.

But unlike botnets built around a central command-and-control server, Sality relied on infected computers communicating directly with one another. The decentralized design made the network resilient to normal sinkholing as there was no single server that the network could have been redirected away from or toward.

CrowdStrike researcher Tillmann Werner told Reuters the disruption required extensive reverse-engineering and was the most complex botnet takeover the company had ever conducted. According to a post on the company’s blog, it was ultimately able to sever the connection between more than 15,000 infected computers.

Investigators targeted the mechanism Sality used to maintain the decentralized network. Each infected machine keeps a list of publicly reachable systems known as “super peers” that help pass information between bots, and CrowdStrike said its researchers targeted these lists.

By injecting false information into the “super peer” lists, the company was able to cause infected computers to lose contact with other members of the botnet and, ultimately, its operator. The isolated machines could no longer receive commands or download new malware.

No arrests were announced and authorities have not publicly identified the operator. CrowdStrike assesses that the group behind Sality operates from the Bashkortostan region in Russia.

Authorities said they also moved against infrastructure outside the peer-to-peer network, with Sality-linked domains in the U.S. being seized, while authorities in Bulgaria, Hungary and Romania seized additional domains in Europe that infected systems could otherwise have used to retrieve new payloads.

Sality began in 2003 as a virus that infected executable files, spreading when compromised files were copied between computers. It later developed into a peer-to-peer botnet capable of distributing malware used for credential theft, spam, proxy services, network exploitation and denial-of-service attacks.

For roughly the past eight years, CrowdStrike said, Sality primarily distributed EggJagger, malware designed to monitor a computer’s clipboard for cryptocurrency wallet addresses. When one is detected, EggJagger can replace the copied address with one controlled by the attacker, redirecting a payment if the victim does not notice the substitution before completing the transaction.

CrowdStrike estimated the operator stole at least $150,000 in cryptocurrency through this technique. It said the total takings were enough to sustain a single criminal actor operating with minimal overhead, but noted payloads other than EggJagger may have provided additional revenue streams.

Shadowserver is working with internet service providers and national computer-security response teams to identify the more than 15,000 infected systems still connected to Sality when it was disrupted and to alert their owners.

David Watson, a director at Shadowserver, told Reuters that Sality was “quite old-school” but said the botnet remained dangerous because compromised machines could still provide attackers with a foothold inside organizations.

U.S. officials presented the action as an example of cooperation between law enforcement and the cybersecurity industry and linked it to the Trump administration’s cyber strategy, whose first pillar calls for the U.S.to shape adversary behavior.

Sality’s operator remains publicly unidentified and at large. It is not clear if the disruption will prevent them from attempting to rebuild the botnet or develop replacement infrastructure.