Newly Discovered PowMix Botnet Hits Czech Workers Using Randomized C2 Traffic

A previously undocumented botnet called PowMix targets Czech workers since December 2025, using advanced evasion and randomized C2 beaconing.

• •Uses randomized beaconing intervals with jitter (0-261 seconds initially, 1,075-1,450 seconds later) to evade network signature detection
• •Distributed via phishing emails containing malicious ZIP files with LNK shortcuts that launch PowerShell loaders extracting encrypted malware in memory
• •Establishes persistence through scheduled tasks with remote access, reconnaissance, and arbitrary code execution capabilities
• •Supports #KILL command for self-deletion and #HOST command for dynamic C2 server migration
• •Shares tactical overlap with ZipLine campaign, using similar ZIP-based delivery and Heroku for C2 infrastructure