PowMix Botnet

Cybersecurity researchers have identified an ongoing malicious campaign targeting the workforce in the Czech Republic since at least December 2025. At the center of this operation is a previously undocumented botnet known as PowMix. This threat is engineered to evade traditional detection mechanisms by avoiding persistent connections to its Command-and-Control (C2) infrastructure, instead relying on randomized communication patterns.

Stealth Communication: Advanced C2 Evasion Techniques

PowMix leverages sophisticated methods to remain undetected within network environments. Rather than maintaining continuous contact with its C2 servers, it uses randomized beaconing intervals generated via PowerShell commands. These intervals initially range from 0 to 261 seconds and later extend to between 1,075 and 1,450 seconds, effectively disrupting predictable traffic patterns.

Additionally, the botnet embeds encrypted heartbeat data and unique victim identifiers directly into C2 URL paths, mimicking legitimate REST API traffic. This design enables the malware to blend seamlessly with normal network communications. The botnet is also capable of dynamically updating its C2 domain through its configuration file, ensuring operational continuity even if infrastructure changes.

Infection Chain: Multi-Stage Deployment Strategy

The attack begins with a malicious ZIP archive, typically distributed through phishing emails. Once opened, the archive triggers a carefully orchestrated, multi-stage infection process:

• A Windows Shortcut (LNK) file initiates execution
• A PowerShell loader extracts and decrypts the embedded payload
• The malware is executed directly in memory, minimizing disk artifacts

This fileless execution approach significantly reduces the likelihood of detection by conventional security tools.

Capabilities and Persistence Mechanisms

PowMix is designed as a versatile remote access tool, enabling attackers to conduct reconnaissance, execute arbitrary code, and maintain long-term control over compromised systems. Persistence is achieved through the creation of scheduled tasks, ensuring the malware remains active across system reboots.

To maintain operational stability, the malware verifies the process tree to prevent multiple instances from running simultaneously on the same host.

Command Execution Framework: Flexible Control Architecture

The botnet supports two primary categories of commands issued from the C2 server. Its behavior is determined by the format of the server's response:

Commands without a '#' prefix trigger arbitrary execution mode, prompting the malware to decrypt and execute received payloads

Special commands include:

#KILL: Initiates self-deletion and removes all traces of malicious activity

#HOST: Updates the botnet’s C2 server address for continued communication

This flexible command structure allows operators to adapt the malware's behavior in real time.

Social Engineering Layer: Decoy Documents as Distraction

To further its effectiveness, the campaign incorporates social engineering tactics. Victims are presented with decoy documents featuring compliance-related themes designed to appear legitimate. These documents reference well-known brands such as Edeka and include compensation details alongside legitimate legislative references. Such elements are intended to build trust and deceive targets, particularly job seekers, into engaging with the malicious content.

Tactical Overlap: Links to the ZipLine Campaign

Analysis reveals similarities between PowMix and a previously disclosed campaign known as ZipLine, which targeted supply chain-critical manufacturing sectors in August 2025. Shared tactics include ZIP-based payload delivery, persistence via scheduled tasks, and the use of Heroku infrastructure for C2 operations.

Despite these overlaps, no additional payloads beyond the PowMix botnet itself have been observed. This leaves uncertainty regarding the ultimate objectives of the campaign, suggesting that further developments or secondary-stage payloads may emerge in the future.