Phorpiex Delivers Ransomware With Old School Tactics, and if you involve yourself with internet security on any level, you’re probably already familiar with the name. It’s a malicious botnet that has been around for years, and the people who control it have taken steps to keep it relevant.
Phorpiex is finding new ways to deliver ransomware and other threats, sometimes by moving in the other direction and going decidedly Old School. Recently, this has included the use of worm-like functionality to replicate itself far and wide.
Of interest, Phorpiex ransomware itself came under attack back in the early part of 2020, when an unknown attacker hijacked it on the back end and started uninstalling the modules that allowed the botnet to spam copies of its malicious payload.
According to the security firm Check Point, one of the more common payloads with Phorpiex ransomware is the Avaddon ransomware, a “ransomware as a service,” which means it rents out to other hackers to infect an even more comprehensive range of targets.
As Check Point analysts note:
“Phorpiex is one of the oldest and most persistent botnets, and has been used by its creators for many years to distribute other malware payloads such as GandCrab and Avaddon ransomware, or for sextortion scams.”
In recent months, the botnet has found its way onto Microsoft’s radar. Its controllers have tweaked it to modify Windows registry keys to disable antivirus and firewall popups and override browser settings, making it more difficult to detect and stop.
Enterprise clients can circumvent these shenanigans by enabling Tamper Protection in Microsoft Defender for Endpoint, but home users aren’t so lucky.
Based on Check Point’s statistics, Phorpiex delivers ransomware is currently the largest botnet in existence. Since law enforcement recently defanged the dreaded Emotet botnet, researchers have tracked its activities across more than 160 different countries, giving it a truly global reach. Stay alert for this one. It’s a legitimate threat that can hit you no matter where you are or where you do business.