MALWARE FAMILY

Phorpiex

Internal ID: win.phorpiex

aliases

Last seen:Mar 17, 2026

Intelligence Profile

Proofpoint describes Phorpiex/Trik as a SDBot fork (thus IRC-based) that has been used to distribute GandCrab, Pushdo, Pony, and coinminers. The name Trik is derived from PDB strings.

Threat Analysis

Phorpiex is a malware family tracked by threat intelligence researchers and catalogued in the Malpedia dataset. It represents a distinct malicious software lineage with identifiable code characteristics, behaviors, and victimology.

External References

→https://bin.re/blog/phorpiex/

→https://blog.trendmicro.com/trendlabs-security-intelligence/shylock-not-the-lone-threat-targeting-skype/

→https://blogs.vmware.com/security/2021/11/telemetry-peak-analyzer-an-automatic-malware-campaign-detector.html

→https://research.checkpoint.com/2019/phorpiex-breakdown/

→https://research.checkpoint.com/2020/phorpiex-arsenal-part-i/

→https://research.checkpoint.com/2021/phorpiex-botnet-is-back-with-a-new-twizt-hijacking-hundreds-of-crypto-transactions/

→https://securingtomorrow.mcafee.com/other-blogs/mcafee-labs/evolution-of-malware-sandbox-evasion-tactics-a-retrospective-study/

→https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/nemty-ransomware-trik-botnet

→https://therecord.media/phorpiex-botnet-shuts-down-source-code-goes-up-for-sale/

→https://twitter.com/_CPResearch_/status/1447852018794643457

Quick Facts

TypeMalware Family

Aliases1

Also Known As

win.phorpiex

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search Phorpiex