Cybersecurity researchers have warned about an active malicious campaign targeting the workforce in the Czech Republic using a previously unknown botnet. pomix At least from December 2025.
“PowMix employs random command-and-control (C2) beaconing intervals instead of continuous connections to C2 servers to avoid network signature detection,” Cisco Talos researcher Chetan Raghuprasad said in a report published today.
“PowMix embeds encrypted heartbeat data with the victim machine’s unique identifiers into C2 URL paths, mimicking legitimate REST API URLs. PowMix has the ability to remotely update new C2 domains dynamically in the botnet configuration file.”
The attack chain begins with a malicious zip file, possibly distributed via phishing email, to activate a multi-step infection chain that degrades Pomix. Specifically, it includes a Windows shortcut (LNK) that is used to launch the PowerShell loader, which then extracts the malware embedded within the archive, decrypts it, and runs it in memory.
The never-before-seen botnet is designed to facilitate remote access, reconnaissance, and remote code execution while establishing persistence through a determined task. Additionally, it verifies the process tree to ensure that no other instances of the same malware are running on the compromised host.
Pomix’s remote management logic allows it to process two different types of commands sent from the C2 server. Any non #-prefixed response causes pomix to shift into arbitrary execution mode and decrypt and run the received payload.
- #KILL, to initiate the self-deletion process and erase all traces of malicious artifacts.
- #HOST, to enable C2 migration to the new server URL.
In parallel, it also opens a fake document with a compliance-themed lure as a distraction mechanism. The lure documents reference legitimate brands like Edeka and include compensation data and legitimate legislative references, likely in an effort to enhance their credibility and deceive recipients into looking like job seekers.
Talos said the campaign shares some degree of tactical overlap with a campaign called Zipline, which was revealed by Check Point in late August 2025 as targeting supply chain-critical manufacturing companies with in-memory malware called Mixshell.
This includes the use of similar zip-based payload delivery, scheduled task persistence, and abuse of Heroku for C2. That said, no final payload beyond botnet malware has been observed, leaving questions about its exact purposes unanswered.
“Pomix avoids constant connections to C2 servers,” Talos said. “Instead, it implements a jitter via the get-random PowerShell command to vary the beaconing interval initially between 0 and 261 seconds and later between 1,075 and 1,450 seconds. This technique attempts to prevent detection of C2 traffic through predictable network signatures.”
The disclosure comes as BitSight sheds light on the infection chain associated with the Rondodox botnet, highlighting the malware’s evolved capabilities to illegally mine cryptocurrency on infected systems by using XMRIG on top of existing distributed denial-of-service (DDoS) attack functionality.
The findings paint a picture of an actively created malware that offers improved evasion, improved flexibility, aggressive competition removal, and an expanded feature set.
Rondodox is able to exploit over 170 known vulnerabilities in various Internet-facing applications to gain initial access and drop a shell script that performs basic anti-analysis and removes competing malware before dropping a botnet binary suitable for the architecture.
Joao Godinho, principal research scientist at Bitsight, said the malware “makes multiple checks and implements techniques to circumvent analysis, including use of nanomites, renaming/deleting files, killing processes, and actively probing debuggers during execution.”
“The bot is capable of running DoS attacks at the Internet, transport, and application layers, based on commands and arguments issued by C2.”
