Loading story…
Check Point Research reported that the Phorpiex botnet resumed operations after an earlier shutdown announcement and began distributing a new variant, Twizt, from refreshed command-and-control infrastructure on new IP addresses. The malware adds peer-to-peer resilience so infected systems can keep communicating even if centralized servers are disrupted, and it reconfigures UPnP-enabled home routers to enable port forwarding. Researchers said Twizt uses a custom TCP/UDP protocol with layered encryption and integrity checks to maintain botnet communications.
The revived operation continued Phorpiex’s established cryptocurrency theft model through clipboard hijacking, replacing wallet addresses during transactions. Check Point said the malware supports more than 30 cryptocurrency wallet types and was observed in 96 countries, with significant victim concentrations in Ethiopia, Nigeria, and India. From November 2020 to November 2021, researchers attributed 969 hijacked transactions to the campaign, including 3.64 BTC, 55.87 ETH, and roughly $55,000 in ERC20 tokens, for a total value approaching $500,000 at the time of reporting.
Pull IOCs and campaign context straight into your stack.
10 events from the most recent confirmed update back to the earliest known activity.
An underground forum post dated August 27, 2021, allegedly from the Phorpiex operators, claimed they were going out of business and had sold the source code.
Check Point reported that Phorpiex command-and-control activity fell sharply in summer 2021 and that its C2 servers were shut down in July 2021 for about two months.
During 2021, Check Point telemetry recorded Phorpiex infections in 96 countries, with the largest concentrations in Ethiopia, Nigeria, and India.
Between November 2020 and November 2021, Check Point said Phorpiex hijacked 969 cryptocurrency transactions, stealing 3.64 BTC, 55.87 ETH, and about $55,000 in ERC20 tokens.
A 2019 Check Point report estimated that more than 1,000,000 computers were infected with the Tldr loader associated with Phorpiex.
Check Point reported that in 2018–2019 Phorpiex moved from its IRC bot design to a modular architecture using the HTTP-controlled Tldr loader.
One Phorpiex-linked Bitcoin wallet, 1DYwJZfyGy5DXaqXpgzuj8shRefxQ7jCEw, first appeared in 2018 and later received 11 BTC across more than 500 transactions.
Check Point said Phorpiex has been known since 2016, when it operated as an IRC-based botnet also known as Trik.
Check Point Research reported a resurgence of the Phorpiex botnet through a new variant called Twizt, which adds peer-to-peer functionality and router port forwarding to keep the botnet operating without centralized C2 servers.
Less than two weeks after the shutdown announcement, Phorpiex C2 servers came back online on new IP addresses and the revived infrastructure started distributing the previously unseen Twizt bot.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 67 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported that the **Phorpiex** botnet is being used to run large-scale sextortion spam operations while also delivering additional malware and monetizing infected systems. Point Wild traced a multi-stage infection chain that downloaded payloads from `178.16.54.109`, profiled victims through `ip-api.com` geolocation lookups, and skipped execution in countries including the US, UK, Canada, and Germany. The final payload was identified as the **Phorpiex Twizt downloader**, which established persistence and connected victims to botnet command-and-control infrastructure. Analysis from Point Wild and Bitsight shows the botnet supports multiple criminal revenue streams beyond spam. Infected hosts were observed making high volumes of outbound SMTP connections consistent with mass mailing and abuse of internal mail relays to evade blacklist-based filtering, while sextortion emails falsely claimed webcam compromise and demanded **$1,200 in Bitcoin**. Researchers also found Phorpiex capable of **clipboard hijacking**, **TCP flooding**, ransomware-related activity tied to **Twizt**, and downloading **XMRig** to mine Monero, underscoring the botnet's role as a flexible platform for spam, malware distribution, and follow-on attacks.
Jul 14, 2026
Phorpiex, also tracked as **Trik**, grew from an IRC-controlled Windows worm into a large modular botnet used to spread spam, sextortion emails, cryptocurrency miners, stealers, and ransomware. Early variants copied themselves into hidden directories, set **Run** key persistence, weakened host defenses by adding firewall exceptions and disabling Windows Defender, and accepted commands to download payloads, brute-force SMTP accounts, and mass-mail ZIP-packed malware. Researchers later tied the botnet to more than **1 million infected systems**, with infections observed across **160 countries**, and noted propagation through phishing, removable USB drives, instant messaging, fake software sites, and other malware. Later Phorpiex operations shifted from legacy IRC infrastructure toward HTTP, IP-based, and **DGA**-backed command-and-control centered on the **Tldr** loader, while retaining older spam and worming capabilities. The platform delivered secondary payloads including **XMRig**, **Raccoon Stealer**, **Predator The Thief**, **GandCrab**, **Avaddon**, **Nemty**, **Knot**, **Pony**, and other ransomware, and also used clipboard hijacking and data exfiltration for monetization. Check Point and Microsoft reported resilient infrastructure, including dedicated subnets and payload validation with **RC4** encryption plus **RSA-SHA1** signature checks, while a VNC worm module brute-forced exposed port `5900` systems and drove victims to download malware, underscoring Phorpiex's role as a durable criminal distribution service.
Aug 15, 2026
Emotet resumed large-scale operations after a months-long lull and launched widespread phishing campaigns against enterprises, governments, and international organizations, using invoice lures, malicious Office documents, links to compromised WordPress sites, and increasingly convincing reply-chain emails built from stolen mailbox content. Cisco Talos said sinkholed SMTP domains exposed hundreds of thousands of malicious emails per month and infections across more than 200 countries, while ANSSI warned that French companies and public administrations were being actively targeted and that the malware was again being distributed through the TA542 botnet infrastructure across multiple epochs. The renewed activity restored Emotet’s role as a high-volume initial-access platform that frequently delivered **TrickBot**, **Qbot**, and other payloads that enabled credential theft, lateral movement, and eventual ransomware deployment including **Ryuk** and **Conti**. Reported incidents included phishing aimed at 600 United Nations addresses, infections at Lithuania’s National Center for Public Health and municipalities through password-protected archives sent in hijacked email threads, and a municipal case in Germany where an Emotet-linked intrusion escalated into widespread encryption and a full IT rebuild, reinforcing guidance to isolate infected hosts, investigate for broader compromise, and favor reinstallation over antivirus-only cleanup.
Aug 15, 2026