{"id":625,"date":"2026-04-16T19:12:35","date_gmt":"2026-04-16T19:12:35","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=625"},"modified":"2026-04-16T19:12:35","modified_gmt":"2026-04-16T19:12:35","slug":"newly-discovered-powmix-botnet-hits-czech-workers-using-randomized-c2-traffic","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=625","title":{"rendered":"Newly Discovered PowMix Botnet Hits Czech Workers Using Randomized C2 Traffic"},"content":{"rendered":"
\n

\ue804<\/i>Ravie Lakshmanan<\/span>\ue802<\/i>Apr 16, 2026<\/span><\/span>Botnet \/ Cryptomining<\/span><\/p>\n<\/div>\n

\n
<\/a><\/div>\n

Cybersecurity researchers have warned of an active malicious campaign that’s targeting the workforce in the Czech Republic with a previously undocumented botnet\u00a0dubbed PowMix<\/strong> since at least December\u00a02025.<\/p>\n

\u00abPowMix employs randomized command-and-control (C2) beaconing intervals, rather than persistent connection to the C2 server, to evade the network signature detections,\u00bb Cisco Talos researcher Chetan Raghuprasad said<\/a> in a report published\u00a0today.<\/p>\n

\u00abPowMix embeds the encrypted heartbeat data along with unique identifiers of the victim machine into the C2 URL paths, mimicking legitimate REST API URLs.\u00a0PowMix has the capability\u00a0to remotely update the new C2 domain to the botnet configuration file dynamically.\u00bb<\/p>\n

The attack chain begins with a malicious ZIP file, likely delivered via a phishing email, to activate a multi-stage infection chain that drops PowMix. Specifically, it involves a Windows Shortcut (LNK) that’s used to launch a PowerShell loader, which then extracts the malware embedded within the archive, decrypts it, and runs it in\u00a0memory.<\/p>\n

\n
\"Cybersecurity\"<\/a><\/div>\n<\/div>\n

The never-before-seen botnet is designed to facilitate remote access, reconnaissance, and remote code execution, while establishing persistence by means of a scheduled task. At\u00a0the same time, it verifies the process tree to ensure that another instance of the same malware is not running on the compromised\u00a0host.<\/p>\n

PowMix’s remote management logic allows it to process two different kinds of commands sent from the C2 server. Any\u00a0non #-prefixed response causes PowMix to shift to arbitrary execution mode, and decrypt and run the obtained\u00a0payload.\u00a0<\/p>\n