Executive Summary
Cisco Talos has identified a previously undocumented botnet dubbed "PowMix," which has been active since at least December 2025. The campaign primarily targets the Czech Republic, impersonating the EDEKA brand and regulatory bodies like the Czech Data Protection Act. The threat actor uses compliance and recruitment-themed lure documents to target human resources, legal, and IT professionals across diverse sectors.
Technically, PowMix demonstrates high operational maturity through randomized C2 beaconing intervals, AMSI bypass techniques, and the use of legitimate cloud infrastructure like Heroku. It shares significant tactical overlaps with the earlier ZipLine campaign, including payload delivery mechanisms and bot ID generation logic. The botnet is designed for reconnaissance, remote access, and arbitrary code execution, though the final objectives of the current campaign remain unconfirmed.
This threat is significant due to its evasion capabilities, including in-memory execution and the mimicking of legitimate REST API traffic to disguise command-and-control communications. Organizations in the Czech Republic, specifically those in HR and legal roles, should exercise heightened caution regarding unsolicited compliance-related documents.