Back Gbhackers

Phorpiex Botnet Fuels Ransomware, Sextortion, and Crypto

Gbhackers •Mayura Kathir • April 3, 2026

Hackers are abusing the long-running Phorpiex (Trik) botnet to run large-scale ransomware, sextortion, and crypto-clipping operations, turning one infrastructure into a multi-purpose crime machine. A newer variant called Twizt gives the botnet a hybrid architecture that combines traditional command-and-control (C2) with a peer‑to‑peer (P2P) protocol, allowing infected machines to commands and node lists directly with each […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Phorpiex Botnet Revives Ransomware and Sextortion Operations The Phorpiex botnet, also known as Trik, is being leveraged by hackers to conduct extensive ransomware, sextortion, and crypto-clipping campaigns. This botnet, which has been operational since 2011, has evolved into a versatile criminal platform capable of targeting millions of victims. The recent emergence of a new variant called Twizt incorporates a hybrid architecture, combining traditional command-and-control with peer-to-peer protocols, enhancing its operational capabilities. Attack vectors include sending massive volumes of sextortion emails and deploying ransomware attacks. The botnet's infrastructure allows for efficient distribution of malicious payloads, affecting a wide range of systems. Current reports indicate that the botnet remains active and continues to adapt its methods to evade detection. The ongoing threat poses significant risks to individuals and organizations alike, as the scale of its operations is substantial. 2 sources 65

Extracted Entities

Phorpiex Botnet Fuels Ransomware, Sextortion, and Crypto

The full story

Extracted Entities

Attack Types (2)

Malware (2)

MITRE ATT&CK (1)