Late last week, Check Point Research (CPR) released a report detailing “Twizt”, a new variant of the “Phorpiex” botnet (aka “Trik”). The Phorpiex botnet was first identified in 2016 and is known for its “sextortion spam campaigns, crypto-jacking, cryptocurrency clipping and ransomware spread”. Twizt, however, allows for the botnet to operate successfully without the use of active, centralized command-and-control (C2) servers by operating in “peer-in-peer” mode. The infected computers act as servers and send commands to other bots in a chain formation. The variant can also deploy additional malware and is considered by CPR researchers to be “more stable” than the original botnet which, in turn, makes it “more dangerous” overall. CPR detailed that Phorpiex and its variants support more than thirty (30) wallets for different blockchains and has stolen approximately $500,000 USD through 969 transactions over the last year. Twizt has been observed targeting cryptocurrency users in Ethiopian, Nigeria, the Philippines, Guatemala, and India. An in-depth technical analysis of Twizt as well as indicators of compromise (IOCs) and cryptocurrency wallets can be reviewed in the Check Point Research report below.