MixShell

MixShell is a custom stealthy in-memory backdoor/shellcode implant associated with the ZipLine campaign and later Russia-attributed fake-NDA lure activity linked in reporting to UNK_GreenSec. It has been used against supply chain-critical industries, especially U.S.-based manufacturing organizations, with additional victims reported in Singapore, Japan, Switzerland, and later Europe including the UK, Poland, Italy, and the Czech Republic. Delivery observed in ZipLine relied on social engineering through victims’ public contact forms, prolonged business-themed conversations, and fake NDA or assessment-themed lures that led victims to download malicious ZIP archives, often hosted on herokuapp.com. The ZIPs contained lure documents and a malicious LNK that launched a PowerShell loader, which searched for the original ZIP, extracted an embedded script from ZIP binary data after a hardcoded marker, performed an AMSI bypass, copied files into ProgramData, opened a lure document, established persistence via COM TypeLib hijacking, and executed MixShell in memory. A PowerShell-based MixShell variant was also reported; it added anti-debugging and sandbox checks, used scheduled-task persistence, and executed via conhost.exe. MixShell resolves Windows APIs using a custom ROR4 hashing algorithm, stores configuration after the shellcode body with hex-encoded/XOR-encrypted values, creates a mutex that also serves as a C2 identifier, and primarily uses DNS TXT tunneling for command and control with HTTP fallback after repeated DNS failures. Reported capabilities include command execution, file operations, pipe-based interactive sessions, reverse proxying, and persistence. Tactical overlaps reported between MixShell/ZipLine activity and later PowMix activity included ZIP-based payload concealment, Windows scheduled-task persistence, CRC32-based bot ID generation, and abuse of herokuapp.com for C2 infrastructure. Associated infrastructure in reporting included herokuapp-hosted payload delivery and domains such as tollcrm[.]com, humcrm[.]com, vnrsales[.]com, atriocrm[.]com, and zappiercrm[.]com, with 172.210.58[.]69 identified as an infrastructure node.