Pow Mix botnet targets Czech workforce
Summary: Cisco Talos observed an attacker targeting Czech organizations at various levels with compliance-themed decoy documents impersonating the EDEKA brand and citing the Czech Data Protection Act, aimed at HR, legal, and recruitment staff and at job seekers in IT, finance, and logistics. The campaign delivers the previously unreported PowMix botnet through an LNK-triggered PowerShell loader that extracts the payload from a ZIP archive, bypasses AMSI by setting the amsiInitFailed field to true, and runs the decrypted script in memory.
Bottom line: PowMix generates a Bot ID and scheduled-task name from the victim's Windows ProductID via a CRC32-style checksum, beacons with jitter between 1,075 and 1,450 seconds, and adopts the host's proxy settings and logged-in session tokens so its C2 traffic resembles browser traffic - and Talos says the final payload was unobserved and the intent remains unknown.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026