New “PowMix” Botnet Preys on Czech Workforce with Lure of Compliance

Cisco Talos researchers describe a sophisticated, stealthy botnet named “PowMix” targeting HR, legal, and recruitment teams in the Czech Republic since December 2025. Attackers use ZIP archives containing Windows shortcuts that launch PowerShell loaders, perform an AMSI reflection-based bypass to run in memory, and employ randomized beaconing and Heroku-hosted C2 infrastructure to blend with legitimate REST traffic. The botnet supports remote commands for self-deletion and C2 migration, shows tactical overlap with the earlier ZipLine/MixShell campaigns, and appears focused on espionage and long-term access rather than overt destructive activity.