Loading malware…
Phorpiex, also known as Trik and in newer variants as Twizt, is a long-running Windows worm and botnet that has operated since at least 2011. It evolved from a spam-focused bot into a multi-purpose criminal platform used for worm propagation, mass-mailing, malware delivery, cryptocurrency clipboard hijacking, cryptomining deployment, and ransomware distribution. Recent reporting consistently describes Twizt as the current Phorpiex variant and highlights its hybrid architecture combining traditional command-and-control with peer-to-peer communications, which improves resilience against takedown efforts.
Phorpiex primarily targets Windows systems. It spreads through removable USB media and shared or remote network drives by copying itself and using shortcut-based propagation techniques. It establishes persistence through autorun mechanisms in user and system contexts, creates hidden copies of itself in writable directories, and uses mutexes to enforce single-instance execution. Multiple analyses also show defense-evasion behavior including deletion of Mark-of-the-Web metadata, API hashing or runtime string construction, geofencing and locale-based exclusions, and attempts to weaken host defenses by modifying Windows Defender settings, disabling update-related services, and abusing firewall allow-listing.
A notable monetization feature in modern Phorpiex builds is cryptocurrency theft via clipboard hijacking. Twizt monitors clipboard activity, validates copied wallet-address formats across numerous blockchain ecosystems, and replaces them with attacker-controlled addresses. Some variants also act as downloaders that retrieve and execute follow-on payloads, including XMRig-based Monero miners and ransomware. Phorpiex infrastructure has been linked to delivery of LockBit Black and Global Group ransomware, including campaigns that used phishing emails and weaponized Windows shortcut files to launch PowerShell-based infection chains. Phorpiex has also been associated with large-scale sextortion spam operations that send forged or relay-assisted email at high volume and demand cryptocurrency payments.
Botnet functionality includes command retrieval, worker-threaded tasking, storage and drive enumeration, SMTP-based spam distribution, and in some cases TCP flooding consistent with DDoS behavior. Recent Twizt analyses describe peer management data stored locally, asynchronous networking, encrypted botnet communications, and UPnP-based NAT traversal to expose infected hosts for peer-to-peer operations. The malware has also been observed downloading additional criminal tooling from the same infrastructure, reinforcing its role as both a worm and a delivery platform within broader malware-as-a-service and affiliate ecosystems.
Phorpiex activity has been observed globally, with telemetry indicating tens of thousands of active infections per day and campaigns affecting multiple regions while often excluding Russia, other CIS locales, or selected Western countries depending on operator objectives. It is widely associated with financially motivated cybercrime rather than espionage, and its infrastructure has repeatedly overlapped with bulletproof hosting and other commodity malware delivery networks.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
A single 11KB Phorpiex worm dropper hit MalwareBazaar at 02:10 UTC on April 20, 2026.
33 distinct techniques documented for this family, organized by ATT&CK tactic.
Phorpiex is a worm that spreads through USB drives and network drives.
Possible Initial Infection Vectors... Malvertising campaigns redirect users to malware-hosting websites. Fake software or browser update prompts.
Possible Initial Infection Vectors Based on the observed infection chain and historical Phorpiex activity, victims were likely targeted through one or more of the following delivery mechanisms: Large-scale spam email campaigns containing malicious attachments. Phishing emails with links to downloader malware.
Possible Initial Infection Vectors Based on the observed infection chain and historical Phorpiex activity, victims were likely targeted through one or more of the following delivery mechanisms: Large-scale spam email campaigns containing malicious attachments.
If the malware was successfully copied to one of the paths mentioned above, it then attempts to add a new record named Windows Settings to Software\Microsoft\Windows\CurrentVersion\Run... in addition for stopping the services, the malware also disables them completely through the registry.
It also uses API Hashing to conceal the Windows functions it calls at runtime, and builds suspicious strings in memory byte by byte to bypass static security scanners.
After the mutex is created, the malware attempts to delete the zone identifier... the malware attempts to get the Alternate Data Stream (ADS) of the file, specifically the Zone.Identifier stream, and deletes it using DeleteFileW.
The malware parses the response received from the external geolocation service and extracts the value associated with the countryCode field. The extracted country code is compared against a hardcoded list of countries... If the infected system is determined to be located within one of the specified countries, the malware displays a message box and immediately terminates execution via ExitProcess().
If the malware was successfully copied to one of the paths mentioned above, it then attempts to add a new record named Windows Settings to Software\Microsoft\Windows\CurrentVersion\Run... in addition for stopping the services, the malware also disables them completely through the registry.
Observed functionality includes downloading secondary executables, gathering host information, and determining the victim’s geographic location.
The malware parses the response received from the external geolocation service and extracts the value associated with the countryCode field. The extracted country code is compared against a hardcoded list of countries... If the infected system is determined to be located within one of the specified countries, the malware displays a message box and immediately terminates execution via ExitProcess().
the malware creates two .dat files that are part of its configuration, those files are tbtnds.dat and tbtcmds.dat . It seems that those files are responsible for storing data about commands that were received from the C2 server and information about other known hosts.
Each batch file contained approximately 8,000 plaintext email:password credential pairs.
more than 1,350 active command-and-control (C2) servers were identified across 98 infrastructure providers in the region within just three months. | The Phorpiex (Twizt) botnet was found running on Syrian Telecom infrastructure, using a hybrid setup combining standard web communication with a peer-to-peer layer to deliver encrypted payloads
The first thread acts as the primary C2 callback mechanism, connecting to remote command servers on a 14-hour schedule and downloading malicious commands by constructing URLs from hardcoded C2 addresses with numbered suffixes.
Point Wild observed the process establishing multiple concurrent SMTP connections to numerous external mail servers shortly after execution... This pattern is consistent with malware leveraging infected systems to distribute large volumes of email messages as part of a spam or botnet-driven operation.
The same infected machine connects to the local mail server (192.168.4.103:25). Because it’s internal and locally authenticated, the mail server SKIPS Spamhaus checks... The mail server accepts the relay request and forwards sextortion emails with spoofed sender addresses
The Phorpiex (Twizt) botnet was found running on Syrian Telecom infrastructure, using a hybrid setup combining standard web communication with a peer-to-peer layer
During dynamic analysis, it was observed that the sample invokes the URLDownloadToFileW API from urlmon.dll to retrieve a remote payload from a remote server... This behavior demonstrates that the analyzed sample functions as a downloader, where the initial executable retrieves a secondary-stage payload from an external server and stores it within the user’s temporary directory for subsequent execution.
After setting up persistence, the malware attempts to disable security controls by running the following command: /c powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"
73 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
26 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Malware / Outils # Mycelium Framework (botnet) Mirai (botnet) DorkBot (botnet) RageBot (botnet) Phorpiex (botnet) IRCBot.HI (botnet)
Phorpiex is described as a multifunctional botnet malware family used for large-scale spam and sextortion distribution. In this campaign it uses staged downloaders, geolocation checks, persistence, C2 communications, mass SMTP spam delivery, worm-like propagation, clipboard hijacking for cryptocurrency theft, and botnet activity including TCP flooding/DDoS behavior.
Botnet referenced as part of the commodity malware pipeline and observed dropping follow-up payloads.
The content only explicitly references Phorpiex as a downloader in the cited reference. No additional behavioral details are provided in the content itself.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.