Loading story…
Researchers detailed Backdoor.Win32.Plurox, a modular Windows backdoor that gives attackers remote access, installs cryptocurrency miners and other payloads, and moves laterally across local networks. The malware communicates with hardcoded command-and-control servers over TCP, uses simple XOR obfuscation, and supports commands to download, update, delete, and manage both the core bot and its plugins. Investigators observed separate operational subnets, including one focused on miner delivery and another distributing both miners and additional modules.
Plurox’s plugin architecture enabled aggressive internal-network propagation. A UPnP module temporarily forwarded router ports 135 and 445 to expose internal Windows services, while an SMB module spread using the EternalBlue exploit, echoing techniques associated with UPnProxy/EternalSilence-style abuse of exposed services. Researchers also found the SMB plugin closely resembled the wormDll32 component from Trojan.Win32.Trickster, suggesting a possible code relationship between the malware families, and published command-and-control infrastructure and file hashes as indicators of compromise.
Pull IOCs and campaign context straight into your stack.
2 events from the most recent confirmed update back to the earliest known activity.
Kaspersky published research on Backdoor.Win32.Plurox, describing it as a modular Windows backdoor capable of remote access, lateral movement via EternalBlue, and installation of cryptocurrency miners and other plugins. The report also disclosed command-and-control infrastructure, plugin behavior, and code similarities between Plurox's SMB plugin and Trickster's wormDll32 module.
An Akamai blog post described the EternalSilence technique, which abuses UPnP to forward ports on routers. Kaspersky later noted Plurox's UPnP plugin was very similar to EternalSilence, differing by forwarding port 135 instead of 139.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 23 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Phorpiex, also tracked as **Trik**, grew from an IRC-controlled Windows worm into a large modular botnet used to spread spam, sextortion emails, cryptocurrency miners, stealers, and ransomware. Early variants copied themselves into hidden directories, set **Run** key persistence, weakened host defenses by adding firewall exceptions and disabling Windows Defender, and accepted commands to download payloads, brute-force SMTP accounts, and mass-mail ZIP-packed malware. Researchers later tied the botnet to more than **1 million infected systems**, with infections observed across **160 countries**, and noted propagation through phishing, removable USB drives, instant messaging, fake software sites, and other malware. Later Phorpiex operations shifted from legacy IRC infrastructure toward HTTP, IP-based, and **DGA**-backed command-and-control centered on the **Tldr** loader, while retaining older spam and worming capabilities. The platform delivered secondary payloads including **XMRig**, **Raccoon Stealer**, **Predator The Thief**, **GandCrab**, **Avaddon**, **Nemty**, **Knot**, **Pony**, and other ransomware, and also used clipboard hijacking and data exfiltration for monetization. Check Point and Microsoft reported resilient infrastructure, including dedicated subnets and payload validation with **RC4** encryption plus **RSA-SHA1** signature checks, while a VNC worm module brute-forced exposed port `5900` systems and drove victims to download malware, underscoring Phorpiex's role as a durable criminal distribution service.
Aug 15, 2026
Internet-wide scans found the NSA-linked **DoublePulsar** SMB backdoor on tens of thousands of exposed Windows systems after Shadow Brokers released offensive tooling tied to the implant. Researchers reported infection estimates ranging from roughly 30,000 to more than 120,000 hosts, with infected machines responding to distinctive traffic over port `445`; Microsoft questioned the early counts, but independent investigators said the backdoor had spread rapidly and Countercept later published a method to remotely remove it. Because DoublePulsar operates in memory and leaves no files on disk, it was described as unusually stealthy even as defenders raced to identify and clean compromised systems. Subsequent reporting showed the impact of the leak extended well beyond the initial infections. Symantec said a China-linked group known as **Buckeye/APT3** had used a DoublePulsar variant and related NSA exploit code in real-world attacks as early as March 2016, indicating the capabilities were exposed or replicated long before the public dump. Other leaked SMB exploits, including **EternalChampion**, **EternalRomance**, and **EternalSynergy**, were later ported to work across Windows versions from 2000 through modern releases, while related Shadow Brokers tools such as **EternalBlue** were tied to major outbreaks including **WannaCry** and **NotPetya**, reinforcing the urgency of applying Microsoft’s `MS17-010` patches.
Jun 29, 2026
Trend Micro reported an APT intrusion involving **PlugX** malware in which the attacker used remotely created **one-time scheduled tasks** to execute payloads, rather than relying on scheduled tasks for persistence or privilege escalation. Investigators found the same user account was used to launch both PlugX and an auxiliary tool, a technique that likely complicated forensic reconstruction and **EDR** root-cause analysis while blending malicious activity with legitimate administration patterns. The attacker also deleted tools from disk quickly—often within **15 minutes**—reducing opportunities for responders to recover artifacts and analyze the toolset. Trend Micro said PlugX remained difficult to detect because it abused a legitimate-looking normal file, and it advised defenders to hunt for anomalous file locations, suspicious hashes and digital signers, mapped Windows administrative shares, and unusual scheduled-task activity as indicators of infection and lateral movement.
Aug 14, 2026