{"id":233389,"date":"2026-04-16T13:52:00","date_gmt":"2026-04-16T17:52:00","guid":{"rendered":"https:\/\/news-you-need.com\/index.php\/2026\/04\/16\/newly-discovered-powmix-botnet-hits-czech-workers-using-randomized-c2-traffic\/"},"modified":"2026-04-20T12:10:10","modified_gmt":"2026-04-20T16:10:10","slug":"newly-discovered-powmix-botnet-hits-czech-workers-using-randomized-c2-traffic","status":"publish","type":"post","link":"https:\/\/news-you-need.com\/index.php\/2026\/04\/16\/newly-discovered-powmix-botnet-hits-czech-workers-using-randomized-c2-traffic\/","title":{"rendered":"Newly Discovered PowMix Botnet Hits Czech Workers Using Randomized C2 Traffic"},"content":{"rendered":"

Newly Discovered PowMix Botnet Hits Czech Workers Using Randomized C2 Traffic<\/a><\/p>\n

https:\/\/thehackernews.com\/2026\/04\/newly-discovered-powmix-botnet-hits.html<\/a><\/p>\n

Publish Date: 2026-04-16 13:52:00<\/a><\/p>\n

Source Domain: thehackernews.com<\/a><\/p>\n

\ue804Ravie Lakshmanan<\/span>\ue802Apr 16, 2026<\/span><\/span>Botnet \/ Cryptomining<\/span><\/p>\n

Cybersecurity researchers have warned of an active malicious campaign that’s targeting the workforce in the Czech Republic with a previously undocumented botnet\u00a0dubbed PowMix<\/strong> since at least December\u00a02025.<\/p>\n

“PowMix employs randomized command-and-control (C2) beaconing intervals, rather than persistent connection to the C2 server, to evade the network signature detections,” Cisco Talos researcher Chetan Raghuprasad said in a report published\u00a0today.<\/p>\n

“PowMix embeds the encrypted heartbeat data along with unique identifiers of the victim machine into the C2 URL paths, mimicking legitimate REST API URLs.\u00a0PowMix has the capability\u00a0to remotely update the new C2 domain to the botnet configuration file dynamically.”<\/p>\n

The attack chain begins with a malicious ZIP file, likely delivered via a phishing email, to activate a multi-stage infection chain that drops PowMix. Specifically, it involves a Windows Shortcut (LNK) that’s used to launch a PowerShell loader, which then extracts the malware embedded within the archive, decrypts it, and runs it in\u00a0memory.<\/p>\n

The never-before-seen botnet is designed to facilitate remote access, reconnaissance, and remote code execution, while establishing persistence by means of a scheduled task. At\u00a0the same time, it verifies the process tree to ensure that another instance of the same malware is not running on the compromised\u00a0host.<\/p>\n

PowMix’s remote management logic allows it to process two different kinds of commands sent from the C2 server. Any\u00a0non #-prefixed response causes PowMix to shift to arbitrary execution mode, and decrypt and run the obtained\u00a0payload.\u00a0<\/p>\n