PowMix Botnet Targets Czech Workforce via LNK-Triggered PowerShell Loader with Heroku C2 — Threadlinqs Intelligence
As of 2026-05-30, PowMix Botnet Targets Czech Workforce via LNK-Triggered PowerShell Loader with Heroku C2 is a high-severity malware threat attributed to PowMix Operators (N/A), tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 28 indicators of compromise.
Threat ID: TL-2026-0375 · Severity: HIGH · Status: ACTIVE · Category: MALWARE
Attribution: PowMix Operators · N/A · UNKNOWN
Cisco Talos discovered PowMix, a previously undocumented PowerShell botnet operating since December 2025, targeting Czech organizations across HR, legal, and recruitment sectors. The botnet delivers
PowMix is a previously undocumented PowerShell-based botnet discovered by Cisco Talos Intelligence, actively targeting Czech organizations since at least December 2025. The campaign focuses on the Czech workforce across human resources, legal, and recruitment sectors, using sophisticated phishing lures themed around EDEKA brand impersonation, Czech Data Protection Act compliance documentation, compensation data, and job recruitment postings spanning IT, finance, and logistics roles.
The infection chain begins with phishing emails delivering malicious ZIP archives containing Windows shortcut (LNK) files alongside legitimate-looking decoy documents. When a victim executes the LNK file, it triggers a PowerShell loader that copies the ZIP archive to the ProgramData directory. The loader then searches the ZIP binary data for a specific marker string 'zAswKoK', extracting the embedded PowMix payload positioned after this marker — a technique for concealing malicious code within ZIP file structures previously observed in the related ZipLine campaign.
Before executing the payload, the loader performs an AMSI (Antimalware Scan Interface) bypass using .NET reflection to set the AmsiUtils.amsiInitFailed field to true, effectively disabling Windows antimalware scanning for the current PowerShell process. The PowMix botnet code is then executed entirely in memory via Invoke-Expression (IEX), leaving minimal forensic artifacts on disk.
PowMix establishes persistence through Windows scheduled tasks configured to run daily at 11:00 AM. The scheduled task name is a hex-encoded string derived from the CRC32 hash of the BotID combined with a configuration hash, making each persistence entry unique per infection. The task launches explorer.exe with a path to the malicious LNK file, re-triggering the infection chain on each execution.
The command-and-control infrastructure leverages Heroku, a legitimate Platform-as-a-Service provider, to host HTTPS C2 endpoints. PowMix implements randomized beaconing with initial intervals of 0-261 seconds and subsequent intervals of 1075-1450 seconds, making detection through network timing analysis difficult. The bot embeds its BotID within URL paths that mimic legitimate REST API calls, blending C2 traffic with normal web application traffic. All communications are encrypted using XOR with hardcoded keys (including HpSWSb, qDQyxQE, bKUxmhyAe, HymzqLse, KsEYwmgSF, ujCPOEPU). The bot uses a Chrome User-Agent string and is proxy-aware, allowing it to operate in corporate environments with web proxies.
PowMix supports three primary commands from the C2 server: #KILL for self-deletion and cleanup of all persistence artifacts, #HOST for C2 domain migration via encrypted configuration updates enabling infrastructure rotation, and arbitrary PowerShell execution via IEX for flexible post-exploitation activities.
Significant TTP overlaps exist with the ZipLine campaign documented by Check Point Research in August 2025, which deployed the MixShell malware. Both campaigns share ZIP-based payload concealment using marker strings (ZipLine uses 'xFIQCV', PowMix uses 'zAswKoK'), scheduled task persistence mechanisms, CRC32-based BotID generation algorithms, AMSI bypass via AmsiUtils reflection, and abuse of Heroku infrastructure for C2 communications. This overlap suggests PowMix may represent an evolution or regional variant of the same threat actor toolset, potentially linked to the financially motivated cluster tracked as UNK_GreenSec by Proofpoint.
Cisco Talos has released ClamAV signatures (Lnk.Trojan.PowMix-10059735-0, Txt.Trojan.PowMix-10059742-0, Txt.Trojan.PowMix-10059778-0, Win.Trojan.PowMix-10059728-0) and Snort rule SID 66118 to detect PowMix activity.
Target sectors: human-resources, legal, recruitment, information-technology, finance, logistics
Target regions: Czech Republic, Central Europe
Detections & IOCs
As of 2026-07-26, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 28 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
MALWARE, HIGH, threat intelligence, cybersecurity, T1566, T1059, T1204, T1053, T1562, T1140, T1027, T1036, T1620, T1071