Cisco Talos uncovered a botnet tracked as PowMix that has been active since at least December 2025 and is aimed at organizations in the Czech Republic. The infection chain begins with malicious LNK files that trigger a PowerShell loader, which unpacks a ZIP archive, bypasses AMSI protections, and launches the PowMix payload directly in memory. Once established, the malware maintains persistence through a scheduled task with a randomized hexadecimal name and uses a global mutex to control execution. PowMix communicates with its command-and-control infrastructure through randomized REST-like paths hosted on abused herokuapp.com domains and supports remote command execution, configuration changes, and self-removal.
Talos examined the full LNK-based delivery chain, the PowerShell loader, and the PowMix bot itself, identifying notable similarities to the earlier ZipLine campaign, including ZIP-based payload concealment and the use of Heroku-hosted infrastructure for C2. Researchers documented the malware’s AMSI bypass method, its CRC32-style bot ID generation logic, and beaconing intervals designed with jitter to reduce detection. The team also extracted key indicators, including the scheduled task naming pattern, mutex conventions, and hard-coded XOR key strings embedded in the malware. Detection coverage was further expanded through the creation of ClamAV and Snort signatures.
Organizations should apply strict controls to the execution of LNK files and monitor for PowerShell activity that creates scheduled tasks or global mutexes. AMSI protections should be hardened wherever possible, and script execution should be governed by code-signing requirements and restrictive policies. Security teams should also block or closely inspect outbound traffic to suspicious herokuapp.com domains and review proxy authentication logs for unusual browser-like requests that may indicate PowMix activity. Endpoint detections should be updated to identify the specific PowerShell commands and behaviors used by the loader.
If PowMix-related activity is detected, defenders should isolate the affected host, terminate the malicious PowerShell process, and remove the scheduled task along with any associated files stored under ProgramData . Forensic collection should capture the full execution chain, including command-line artifacts, mutex values, and any downloaded configuration data. Potentially exposed credentials should be reset, and proxy and firewall controls should be updated to block the identified command-and-control domains. Security teams should also monitor network traffic for commands such as #HOST and #KILL , notify relevant stakeholders, and update detection content to reflect the latest indicators.
Prerequisite: The Telemetry & Baseline Pre‑flight Check must have passed.
Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic.
Attack Narrative & Commands: An operator of the PowMix botnet first disables AMSI by invoking a PowerShell one‑liner that sets the internal amsiInitFailed flag to $true . Immediately after, the same PowerShell process creates a named mutex in the global namespace ( GlobalBOT12345 ) to guarantee a single running instance. Both actions are performed from a single command line so that Sysmon logs capture the exact strings the rule looks for.
Regression Test Script:
Join SOC Prime's Detection as Code platform to improve visibility into threats most relevant to your business. To help you get started and drive immediate value, book a meeting now with SOC Prime experts.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
