Phorpiex Botnet Fuels Ransomware, Sextortion, and Crypto-Theft Attacks

The report describes the evolution and active use of the Phorpiex (Trik/Twizt) botnet as a multipurpose crime platform: a hybrid C2/P2P architecture distributes ransomware (including LockBit Black and Global-like families), mass sextortion spam, and crypto‑clipping/seed theft. Operators maintain resilience via encrypted payloads, redundant C2 and P2P peer lists, worm-like removable-drive propagation, and targeted delivery (e.g., domain/server checks and geofencing), resulting in large-scale financial theft and extortion worldwide.