ThreatsDay Bulletin: Hybrid P2P Botnet, 13-Year-Old Apache RCE and 18 More Stories

Key Points:

• A new variant of the Phorpiex botnet, utilizing a hybrid P2P communication model, is being leveraged for cryptocurrency clipping, sextortion spam, and ransomware deployment.
• The botnet is responsible for approximately 125,000 infections daily, primarily affecting countries like Iran and Uzbekistan. Additionally, a critical RCE vulnerability (CVE-2026-34197) in Apache ActiveMQ Classic allows unauthenticated command execution.
• Organizations should enhance monitoring for Phorpiex-related activities, patch vulnerable systems immediately, and implement strong authentication measures to mitigate exploitation risks.

Technical Details: The Phorpiex botnet's Twizt variant combines HTTP polling with P2P protocols to maintain operational continuity. The RCE vulnerability (CVE-2026-34197) can be exploited using default credentials or through an unauthenticated attack on specific ActiveMQ versions.

MITRE ATT&CK Techniques:

• T1071.001 - Application Layer Protocol: Web Protocols (Command and Control)
• T1203 - Exploitation for Client Execution (Execution)
• T1078 - Valid Accounts (Defense Evasion)

IOCs Mentioned: None mentioned