PowMix Botnet Targets Czech Workforce via LNK-Triggered PowerShell Loader with Heroku C2
PowMix Botnet Targets Czech Workforce via LNK-Triggered (TL-2026-0375), also tracked as PowMix, is a high-severity malware campaign, first published 2026-04-16. It is attributed to PowMix Operators with low confidence, affects Microsoft Windows, maps to 18 MITRE ATT&CK techniques (T1005, T1008, T1027), and is covered by 9 detection rules and 28 indicators of compromise.
Key facts for TL-2026-0375
- Threat ID
- TL-2026-0375
- Also known as
- PowMix
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- 2026-04-16
- Last reviewed
- 2026-04-16
- Attribution
- PowMix Operators
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- human-resources, legal, recruitment, information-technology, finance, logistics
- Target regions
- Czech Republic, Central Europe
- Detection rules
- 9
- Indicators of compromise
- 28
Malware and tooling in PowMix Botnet Targets Czech Workforce via LNK-Triggered
Malware and tooling: MixShell, PowMix, PowMix
Cisco Talos discovered PowMix, a previously undocumented PowerShell botnet operating since December 2025, targeting Czech organizations across HR, legal, and recruitment sectors. The botnet delivers via phishing emails containing malicious ZIP archives with LNK shortcuts that trigger a PowerShell loader, bypass AMSI via AmsiUtils reflection, and execute PowMix entirely in memory using Heroku-hosted HTTPS C2 infrastructure with XOR-encrypted communications.
How PowMix Botnet Targets Czech Workforce via LNK-Triggered works
PowMix is a previously undocumented PowerShell-based botnet discovered by Cisco Talos Intelligence, actively targeting Czech organizations since at least December 2025. The campaign focuses on the Czech workforce across human resources, legal, and recruitment sectors, using sophisticated phishing lures themed around EDEKA brand impersonation, Czech Data Protection Act compliance documentation, compensation data, and job recruitment postings spanning IT, finance, and logistics roles.
The infection chain begins with phishing emails delivering malicious ZIP archives containing Windows shortcut (LNK) files alongside legitimate-looking decoy documents. When a victim executes the LNK file, it triggers a PowerShell loader that copies the ZIP archive to the ProgramData directory. The loader then searches the ZIP binary data for a specific marker string 'zAswKoK', extracting the embedded PowMix payload positioned after this marker — a technique for concealing malicious code within ZIP file structures previously observed in the related ZipLine campaign.
Before executing the payload, the loader performs an AMSI (Antimalware Scan Interface) bypass using .NET reflection to set the AmsiUtils.amsiInitFailed field to true, effectively disabling Windows antimalware scanning for the current PowerShell process. The PowMix botnet code is then executed entirely in memory via Invoke-Expression (IEX), leaving minimal forensic artifacts on disk.
PowMix establishes persistence through Windows scheduled tasks configured to run daily at 11:00 AM. The scheduled task name is a hex-encoded string derived from the CRC32 hash of the BotID combined with a configuration hash, making each persistence entry unique per infection. The task launches explorer.exe with a path to the malicious LNK file, re-triggering the infection chain on each execution.
The command-and-control infrastructure leverages Heroku, a legitimate Platform-as-a-Service provider, to host HTTPS C2 endpoints. PowMix implements randomized beaconing with initial intervals of 0-261 seconds and subsequent intervals of 1075-1450 seconds, making detection through network timing analysis difficult. The bot embeds its BotID within URL paths that mimic legitimate REST API calls, blending C2 traffic with normal web application traffic. All communications are encrypted using XOR with hardcoded keys (including HpSWSb, qDQyxQE, bKUxmhyAe, HymzqLse, KsEYwmgSF, ujCPOEPU). The bot uses a Chrome User-Agent string and is proxy-aware, allowing it to operate in corporate environments with web proxies.
PowMix supports three primary commands from the C2 server: #KILL for self-deletion and cleanup of all persistence artifacts, #HOST for C2 domain migration via encrypted configuration updates enabling infrastructure rotation, and arbitrary PowerShell execution via IEX for flexible post-exploitation activities.
Significant TTP overlaps exist with the ZipLine campaign documented by Check Point Research in August 2025, which deployed the MixShell malware. Both campaigns share ZIP-based payload concealment using marker strings (ZipLine uses 'xFIQCV', PowMix uses 'zAswKoK'), scheduled task persistence mechanisms, CRC32-based BotID generation algorithms, AMSI bypass via AmsiUtils reflection, and abuse of Heroku infrastructure for C2 communications. This overlap suggests PowMix may represent an evolution or regional variant of the same threat actor toolset, potentially linked to the financially motivated cluster tracked as UNK_GreenSec by Proofpoint.
Cisco Talos has released ClamAV signatures (Lnk.Trojan.PowMix-10059735-0, Txt.Trojan.PowMix-10059742-0, Txt.Trojan.PowMix-10059778-0, Win.Trojan.PowMix-10059728-0) and Snort rule SID 66118 to detect PowMix activity.
MITRE ATT&CK techniques used in TL-2026-0375
Collection
Command and Control
T1008 Fallback Channels; T1071 Application Layer Protocol; T1102 Web Service; T1132 Data Encoding; T1573 Encrypted Channel
Defense Evasion
T1027 Obfuscated Files or Information; T1036 Masquerading; T1140 Deobfuscate/Decode Files or Information; T1620 Reflective Code Loading
Exfiltration
T1041 Exfiltration Over C2 Channel
Persistence
Execution
T1059 Command and Scripting Interpreter; T1204 User Execution
Impact
Initial Access
Resource Development
defense-impairment
Affected products and versions in PowMix Botnet Targets Czech Workforce via LNK-Triggered
- Microsoft — Windows
Vulnerable versions: 10; 11; Server 2016; Server 2019; Server 2022 - Microsoft — PowerShell
Vulnerable versions: 5.1; 7.x
Remediation for PowMix Botnet Targets Czech Workforce via LNK-Triggered
Immediate actions
- Block all identified Heroku C2 domains at web proxy and DNS level
- Search for scheduled tasks with hex-string names running explorer.exe with LNK paths
- Scan endpoints for PowerShell execution artifacts in ProgramData directory
- Block Snort SID 66118 at network perimeter
- Hunt for ZIP files containing marker string zAswKoK in email gateway logs
- Quarantine emails matching EDEKA brand or Czech Data Protection Act lure themes
Workarounds
- Disable Windows Script Host execution for non-administrative users
- Block LNK file execution from user-writable directories via AppLocker or WDAC
- Restrict PowerShell to Constrained Language Mode via Group Policy
- Block outbound HTTPS to *.herokuapp.com from endpoints where not business-required
Longer-term hardening
- Deploy EDR with behavioral detection for AMSI bypass via AmsiUtils reflection
- Implement PowerShell Constrained Language Mode on endpoints handling sensitive HR/legal data
- Enable PowerShell Script Block Logging and Module Logging for forensic visibility
- Configure web proxy to inspect and alert on Heroku subdomain communications with encoded URL paths
- Implement email gateway rules to detonate ZIP+LNK combinations in sandbox
- Deploy ClamAV signatures Lnk.Trojan.PowMix-10059735-0 through Win.Trojan.PowMix-10059728-0
- Monitor for CRC32-based scheduled task naming patterns across endpoint fleet
Timeline of PowMix Botnet Targets Czech Workforce via LNK-Triggered
- Check Point Research publishes analysis of ZipLine phishing campaign deploying MixShell malware with shared TTPs including Heroku C2 abuse, CRC32 BotID, and ZIP payload concealment
- Earliest observed PowMix botnet activity targeting Czech organizations, marking the beginning of the campaign
- First phishing lures observed using EDEKA brand impersonation and Czech Data Protection Act compliance themes targeting HR and legal departments
- PowMix operators expand Heroku C2 infrastructure with multiple herokuapp subdomains including erpapp, crmassets, and erpsync naming patterns
- Campaign expands targeting to recruitment sector with job posting lures across IT, finance, and logistics roles in Czech Republic
- Cisco Talos Intelligence begins investigation into PowMix botnet after identifying previously undocumented PowerShell botnet samples
- ClamAV signatures (Lnk.Trojan.PowMix-10059735-0 through Win.Trojan.PowMix-10059728-0) and Snort SID 66118 released for PowMix detection
- Cisco Talos publishes full technical analysis of PowMix botnet including IOCs, ClamAV signatures, and Snort rule SID 66118
- As of 2026-05-29, PowMix remains active: Cisco Talos disclosed it 2026-04-16 as an ongoing campaign (live since Dec 2025) hitting the Czech workforce, with no takedown, sinkhole, or arrests reported. The fileless PowerShell botnet abuses Heroku C2 with dynamic domain-migration and ties to the still-active UNK_GreenSec/ZipLine-MixShell cluster.
Sources cited for PowMix Botnet Targets Czech Workforce via LNK-Triggered
- Cisco Talos: PowMix botnet targets Czech workforce
- Cisco Talos IOCs - PowMix Botnet
- Check Point Research: ZipLine Phishing Campaign
- The Hacker News: MixShell Malware Delivered via Contact Forms
- The Register: ZipLine attack uses Contact Us forms
- Dark Reading: ZipLine Phishers Flip Script
- GBHackers: ZipLine Campaign Targets Manufacturing Firms
- Industrial Cyber: ZipLine phishing uses social engineering
- MITRE ATT&CK: Scheduled Task/Job
- MITRE ATT&CK: Disable or Modify Tools - AMSI Bypass
More in malware
- Multi-Stage Cobalt Strike Loader Deploys Stageless Beacon via Anti-Sandbox .NET Chain
- Access-Code-Gated Phishing Chain Delivers Vidar Infostealer via DocuSign Impersonation
- ScarfaceStealer: Electron-Delivered Infostealer with Sandbox-Scoring Evasion and Smart-Contract C2
- Gigabud Android Banking Trojan Clones Banking Apps via Hidden Work Profile (Vwork/GoldFactory)
- LegionLoader Malware Distributed via Fake Cloudflare CAPTCHA Using the ClickFix Technique
Detection coverage for TL-2026-0375
As of 2026-04-16, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0375 across Splunk SPL, Microsoft KQL and Sigma, covering 28 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.