Loading story…
Researchers reported that the Phorpiex botnet is being used to run large-scale sextortion spam operations while also delivering additional malware and monetizing infected systems. Point Wild traced a multi-stage infection chain that downloaded payloads from 178.16.54.109, profiled victims through ip-api.com geolocation lookups, and skipped execution in countries including the US, UK, Canada, and Germany. The final payload was identified as the Phorpiex Twizt downloader, which established persistence and connected victims to botnet command-and-control infrastructure.
Analysis from Point Wild and Bitsight shows the botnet supports multiple criminal revenue streams beyond spam. Infected hosts were observed making high volumes of outbound SMTP connections consistent with mass mailing and abuse of internal mail relays to evade blacklist-based filtering, while sextortion emails falsely claimed webcam compromise and demanded $1,200 in Bitcoin. Researchers also found Phorpiex capable of clipboard hijacking, TCP flooding, ransomware-related activity tied to Twizt, and downloading XMRig to mine Monero, underscoring the botnet's role as a flexible platform for spam, malware distribution, and follow-on attacks.
Pull IOCs and campaign context straight into your stack.
2 events from the most recent confirmed update back to the earliest known activity.
Point Wild reported a multi-stage campaign tied to infrastructure associated with the Phorpiex botnet that used downloader stages, geolocation checks, and country-based execution avoidance before deploying the Phorpiex Twizt downloader. The final payload enabled persistence, botnet C2, spam delivery, clipboard hijacking, TCP flooding, and deployment of an XMRig Monero miner, while monetization relied on sextortion emails demanding $1,200 in Bitcoin.
Bitsight published research on ransomware activity involving the Twizt malware and the Phorpiex botnet, documenting the threat's role in the broader malware ecosystem.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 15 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Phorpiex, also tracked as **Trik**, grew from an IRC-controlled Windows worm into a large modular botnet used to spread spam, sextortion emails, cryptocurrency miners, stealers, and ransomware. Early variants copied themselves into hidden directories, set **Run** key persistence, weakened host defenses by adding firewall exceptions and disabling Windows Defender, and accepted commands to download payloads, brute-force SMTP accounts, and mass-mail ZIP-packed malware. Researchers later tied the botnet to more than **1 million infected systems**, with infections observed across **160 countries**, and noted propagation through phishing, removable USB drives, instant messaging, fake software sites, and other malware. Later Phorpiex operations shifted from legacy IRC infrastructure toward HTTP, IP-based, and **DGA**-backed command-and-control centered on the **Tldr** loader, while retaining older spam and worming capabilities. The platform delivered secondary payloads including **XMRig**, **Raccoon Stealer**, **Predator The Thief**, **GandCrab**, **Avaddon**, **Nemty**, **Knot**, **Pony**, and other ransomware, and also used clipboard hijacking and data exfiltration for monetization. Check Point and Microsoft reported resilient infrastructure, including dedicated subnets and payload validation with **RC4** encryption plus **RSA-SHA1** signature checks, while a VNC worm module brute-forced exposed port `5900` systems and drove victims to download malware, underscoring Phorpiex's role as a durable criminal distribution service.
Aug 15, 2026
Check Point Research reported that the **Phorpiex** botnet resumed operations after an earlier shutdown announcement and began distributing a new variant, **Twizt**, from refreshed command-and-control infrastructure on new IP addresses. The malware adds peer-to-peer resilience so infected systems can keep communicating even if centralized servers are disrupted, and it reconfigures **UPnP-enabled** home routers to enable port forwarding. Researchers said Twizt uses a custom TCP/UDP protocol with layered encryption and integrity checks to maintain botnet communications. The revived operation continued Phorpiex’s established cryptocurrency theft model through **clipboard hijacking**, replacing wallet addresses during transactions. Check Point said the malware supports more than **30 cryptocurrency wallet types** and was observed in **96 countries**, with significant victim concentrations in **Ethiopia, Nigeria, and India**. From November 2020 to November 2021, researchers attributed **969 hijacked transactions** to the campaign, including **3.64 BTC**, **55.87 ETH**, and roughly **$55,000 in ERC20 tokens**, for a total value approaching **$500,000** at the time of reporting.
Aug 14, 2026
Researchers reported that the **Necro** botnet—also tracked as **N3Cr0m0rPh**, **FreakOut**, and **Necromorph**—rapidly evolved from an older Python malware family into an active cross-platform campaign targeting both Linux and Windows systems. Multiple reports tied the operation to exploitation of public-facing flaws including `CVE-2020-28188`, `CVE-2021-3007`, and `CVE-2020-7961`, with later variants adding more n-day exploits such as those affecting TerraMaster, Genexis, Xinuos OpenServer, Zeroshell, and **Visual Tools DVR VX16 4.2.28.0**. The malware also spread through SSH and Telnet brute forcing, and researchers observed infection volumes ranging from hundreds of confirmed download attempts to estimates in the tens of thousands of compromised hosts. The botnet used **IRC-based command and control**, later strengthened with **DGA-generated domains**, **Tor**, **SSL-encrypted communications**, polymorphic code, and PyInstaller-packed binaries to improve resilience and execution. Once installed, Necro enabled **DDoS attacks, reverse shells, persistence, traffic sniffing, ARP poisoning, lateral movement, file infection, and JavaScript injection**, while monetizing access primarily through **XMRig-based Monero mining** and, in some cases, Tezos mining. Cisco Talos also observed a Windows user-mode rootkit and a one-off apparent ransomware delivery attempt, underscoring that the operators were actively adding new payloads and exploit paths as the campaign matured.
Aug 15, 2026