Phorpiex

Also known as: Tldr, Trik, TwizT, phorphiex

Proofpoint describes Phorpiex/Trik as a SDBot fork (thus IRC-based) that has been used to distribute GandCrab, Pushdo, Pony, and coinminers. The name Trik is derived from PDB strings.

C2 Infrastructure

Hosting/VPS 100%

Last 7 days

Jun 26, 2026

C2 Hosts: 63

Daily C2 host counts for the last 7 days
Date	C2 Hosts
Jun 26, 2026	63

Further Reading

The malware that usually installs ransomware and you need to remove right away

If you see any of these malware strains on your enterprise networks, stop everything you're doing and audit all systems.