Newly Discovered PowMix Botnet Hits Czech Workers Using Randomized C2 Traffic
2026-04-16T19:24:13Z•f8c32071c21cc62affde975d534fed89a46dae74a5d26449d80c73c24f9f7efe
RATactive-exploitationbotnetchrome-extensionscisa-kevcomposer-command-injectioncve-trackingjanelaRATmalwaremirax-android-ratn8n-abusenginx-uiobsi dian-pluginopenai-gptpatch-tuesdayphis hingpowmixrandomized-c2sap-sqlishowdoc-rce
What happened
A large set of cybersecurity developments: researchers disclosed the PowMix botnet (active since Dec 2025) targeting Czech workers and using randomized C2 beaconing to evade detection. Multiple high/critical vulnerabilities were disclosed or patched — notably nginx-ui authentication bypass (CVE-2026-33032), Cisco identity/Webex SSO certificate validation flaw (CVE-2026-20184), a critical SAP SQL injection (CVE-2026-27681), Composer Perforce driver command-injection (CVE-2026-40176), ShowDoc RCE (CVE-2025-0520) being actively exploited, and CISA-added KEV issues including Fortinet FortiClient (
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- the_hacker_news
- Record identifier
- f8c32071c21cc62affde975d534fed89a46dae74a5d26449d80c73c24f9f7efe
- Enrichment time
- 2026-04-16T19:24:13Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.