Phorpiex

Phorpiex is a long-running criminal botnet and malware operation associated with large-scale spam distribution, malware delivery, credential theft, and data exfiltration. It has historically been used to propagate additional payloads and monetize infected systems through botnet-enabled cybercrime. The malware ecosystem tied to Phorpiex has been linked to theft-oriented activity and post-compromise collection from victim hosts. Phorpiex is primarily recognized as a financially motivated cybercriminal operation rather than a state-sponsored actor. Its infrastructure has been observed in overlap or proximity with other criminal malware operations, indicating use of shared hosting providers or adjacent criminal infrastructure. In the supplied facts, known Phorpiex command-and-control infrastructure appeared on the same subnet as infrastructure used by a separate Fuery operation, suggesting at minimum shared bulletproof-hosting usage, though not proving common operators. High-confidence characterization of Phorpiex supports its role as a botnet used for initial access, credential theft, and exfiltration in support of financially motivated cybercrime. The available facts here do not directly support ransomware or extortion activity by Phorpiex in this specific context.