{
  "family": "phorpiex",
  "sample_count": 115,
  "category": "spam_bot",
  "description": "Worm:Win32/Phorpiex (also known as Trik) is a massive, highly resilient botnet predominantly known for powering global spam campaigns, sextortion schemes, and distributing secondary malware payloads.<br><br><b>Understanding Phorpiex</b><br>To the average user, a Phorpiex infection might result in their email account being locked for sending spam, or their CPU spiking as the malware mines cryptocurrency. For threat researchers, Phorpiex is a formidable botnet infrastructure that has been active for over a decade. It operates as a multi-purpose malware-as-a-service, primarily monetized through massive email spam runs, clipboard hijacking (to steal cryptocurrency), and dropping ransomware (like GandCrab or Avaddon).<br><br><b>Execution and Evasion Strategies</b><br>Phorpiex spreads via multiple vectors: malicious spam attachments, exploit kits, and lateral movement via infected USB drives and open network shares. Once on a system, it establishes persistence by adding a shortcut to the Windows Startup folder or modifying the Run registry keys. It then contacts its C2 infrastructure to download the latest spam templates and a list of target email addresses. Phorpiex heavily utilizes Domain Generation Algorithms (DGA) or hardcoded IP arrays to maintain resilient C2 communications.<br><br><b>Indicators of Compromise (IoCs)</b><br>Incident responders should monitor network traffic for massive volumes of outbound SMTP connections (port 25) originating from client endpoints—a massive red flag for a spam botnet. Furthermore, investigators should audit the Windows clipboard for unexpected modifications (e.g., a Bitcoin address being dynamically swapped when a user copies it). High CPU utilization from dropped XMRig cryptominers is also a frequent secondary indicator.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [
    "trik",
    "win32.phorpiex",
    "phorpiex.a",
    "phorpiex.b",
    "trik_botnet"
  ],
  "enrichment_level": "expert-seo",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Phorpiex known for?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Spam and sextortion campaigns, USB-based spreading, and clipboard-hijacking to steal cryptocurrency."
      }
    },
    {
      "@type": "Question",
      "name": "How does Phorpiex spread?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Through removable drives and large spam campaigns."
      }
    },
    {
      "@type": "Question",
      "name": "What is a crypto clipper?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Malware that watches the clipboard and replaces a copied wallet address with the attacker's address to divert payments."
      }
    }
  ],
  "faq_count": 3,
  "mitre_attack": [
    "T1115",
    "T1566.001",
    "T1568.002",
    "T1091",
    "T1496"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1566.001",
      "name": "Phishing: Spearphishing Attachment",
      "tactic": "Initial Access"
    },
    {
      "id": "T1091",
      "name": "Replication Through Removable Media",
      "tactic": "Lateral Movement"
    },
    {
      "id": "T1115",
      "name": "Clipboard Data",
      "tactic": "Collection"
    },
    {
      "id": "T1496",
      "name": "Resource Hijacking",
      "tactic": "Impact"
    },
    {
      "id": "T1568.002",
      "name": "Dynamic Resolution: Domain Generation Algorithms",
      "tactic": "Command and Control"
    }
  ],
  "containment_steps": [
    "Block outbound SMTP traffic (TCP port 25) at the perimeter firewall for all client workstations to neuter the spam botnet capabilities.",
    "Isolate the endpoint to prevent the lateral spread of the worm via network shares and USB drives.",
    "Deploy EDR to hunt for unexpected cryptomining processes (e.g., <code>cgminer.exe</code>, <code>xmrig.exe</code>) utilizing high CPU.",
    "Audit all email accounts associated with the user for signs of compromise, as Phorpiex harvests local Outlook credentials to send spam."
  ],
  "what_to_avoid": [
    "Do not ignore a Phorpiex infection as 'just a spam bot'; it is frequently used to drop highly destructive ransomware as a secondary payload.",
    "Avoid paying any sextortion demands generated by the Phorpiex botnet; these are automated scams based on leaked credential dumps, and the attackers do not possess compromising video."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}