Researchers say infections by the Purple Fox botnet malware, first spotted in 2018, continue to rise thanks to a new technique that allows PC-to-PC spread
Context & Ripple Effects
The Purple Fox has been active since 2018, but the new reporting shows its infection count climbing because the malware can now jump from PC to PC — a shift toward worm-style propagation that reduces its dependence on centrally controlled delivery. It follows the same playbook researchers flagged when the P2P botnet FritzFrog began infecting SSH servers at scale in 2020: push command-and-control logic into the infected population itself.
The timing matters because botnet takedowns have repeatedly proven reversible — the [[a:1159367|TrickBot operators quietly rebuilt after US Cyber Command and Microsoft disrupted the botnet]] — so architectures that remove the central infrastructure to take down in the first place are the logical next step.
First-order effects
- Purple Fox operators gain a spreading mechanism that propagates laterally between machines, meaning every infected endpoint becomes a delivery node and Windows users face worm-style exposure without any new phishing or exploit-server dependency.
- Defenders can no longer blunt the campaign by sinkholing or seizing command servers, since the PC-to-PC technique keeps infections growing even if central infrastructure is cut off.
Second-order effects
- Security vendors are pushed to prioritize lateral-movement and peer-to-peer traffic detection on endpoints, not just perimeter blocking — the same adjustment FritzFrog forced on SSH-server defenders.
- Law-enforcement and industry takedown operations lose leverage against botnets built this way, raising the bar for the Microsoft-and-Cyber-Command-style disruptions that have defined botnet response so far.
Third-order effects
- Botnet malware is structurally converging on decentralized, takedown-resistant designs — Purple Fox on PCs, FritzFrog on servers — even as CrowdStrike's data shows the wider intrusion landscape moving toward malware-free techniques, leaving self-spreading botnets as the durable malware niche.
- If the pattern holds, the marginal cost of running a long-lived botnet falls while the cost of disrupting one rises, shifting the defender's burden toward endpoint-level containment and platform-level abuse controls of the kind Meta has had to enforce across its own services.
The trend: Botnets are adopting decentralized, peer-to-peer and machine-to-machine propagation to survive infrastructure takedowns, even as the broader threat landscape shifts toward malware-free intrusions.