ZipLine Campaign Spins Web Around U.S. Supply Chain Manufacturers with MixShell

ZipLine Campaign Targets U.S. Supply Chain with MixShell Malware

Summary

The ZipLine campaign is a targeted social engineering operation that exploits U.S. supply chain–critical manufacturers. Attackers initiate trust-building conversations via corporate “Contact Us” forms and sustain dialogue for up to two weeks before delivering malicious ZIP archives hosted on trusted platforms. These archives deploy MixShell, a sophisticated in-memory malware implant with DNS-based command-and-control (C2), stealth persistence, and advanced evasion techniques. The campaign has expanded globally, impacting organizations in the United States, Singapore, Japan, and Switzerland across industries such as manufacturing, semiconductors, defense, pharmaceuticals, energy, aerospace, and biotech.

Attack Details

Unlike traditional phishing that relies on mass unsolicited emails, ZipLine inverts the tactic by initiating contact through a company’s public “Contact Us” form. Attackers maintain professional, business-oriented conversations under pretexts such as:

• Non-Disclosure Agreements (NDAs) to build trust.

• AI transformation initiatives framed as “AI Impact Assessments” with urgency attributed to leadership requests.

Once trust is secured, attackers deliver a malicious ZIP file containing a weaponized Windows LNK shortcut. This executes a PowerShell-based loader, deploying MixShell into memory.

MixShell Capabilities include:

• Remote command execution and file operations.

• Reverse proxying and stealth persistence.

• DNS tunneling for C2 traffic.

• Anti-debugging, sandbox bypassing, and advanced evasion in its PowerShell variant.

This stealthy malware implant enables prolonged access, persistence, and covert data exfiltration from compromised environments.

Recommendations

1. Harden Endpoint and Network Defenses – Deploy EDR tools capable of detecting in-memory implants, PowerShell-based loaders, and DNS tunneling. Monitor DNS traffic for anomalies.

2. Restrict File & Attachment Handling – Block or sandbox ZIP and LNK files, even from trusted services like Heroku. Restrict PowerShell execution from email attachments.

3. Strengthen Communication Security – Flag prolonged unsolicited business conversations initiated via Contact Us forms. Deploy AI-driven email filtering to detect social engineering patterns.

4. Apply Persistence Controls – Monitor for scheduled tasks, registry keys, and proxy configurations abused by MixShell.

Indicators of Compromise (IoCs)

• SHA256 Hashes (samples):

  • e69d8b96b106816cb732190bc6f8c2693aecb6056b8f245e2c15841fcb48ff94

  • f531bec8ad2d6fddef89e652818908509b7075834a083729cc84eef16c6957d2

  • 83b27e52c420b6132f8034e7a0fd9943b1f4af3bdb06cdbb873c80360e1e5419

• Domains:

  • lvprocurement[.]com

  • lamyconsulting[.]com

  • chipmanconsulting[.]com

  • crmforretailers[.]com

• IPv4 Addresses:

  • 172[.]210[.]58[.]69

  • 212[.]83[.]190[.]143

• URLs (Heroku-hosted):

  • hxxps[:]//signstream-docs-de3fa399b173[.]herokuapp[.]com

  • hxxps[:]//legal-sign-8ec8b9f1edb2[.]herokuapp[.]com

  • hxxps[:]//docsign-hub-3295a03470c3[.]herokuapp[.]com

MITRE ATT&CK TTPs

• Tactics: Reconnaissance (TA0043), Initial Access (TA0001), Execution (TA0002), Persistence (TA0003), Privilege Escalation (TA0004), Defense Evasion (TA0005), Discovery (TA0007), Collection (TA0009), Exfiltration (TA0010), Command and Control (TA0011).

• Techniques:

  • Search Victim-Owned Websites (T1594)

  • Exploit Public-Facing Application (T1190)

  • Phishing (T1566), Spearphishing Attachment (T1566.001)

  • PowerShell Execution (T1059.001)

  • Scheduled Task Persistence (T1053.005), Registry Run Keys (T1547.001)

  • Process Injection (T1055)

  • Virtualization/Sandbox Evasion (T1497)

  • DNS Tunneling (T1071.004)

  • Internal Proxy (T1090.001)

  • Exfiltration Over C2 Channel (T1041)

References

• Check Point Research – ZipLine Phishing Campaign

• Hive Pro – AI Malvertising Trap

• Hive Pro – Operation Deceptive Prospect