New ZipLine Campaign Targets Critical Manufacturing Firms with In-Memory MixShell Malware

Check Point Research has uncovered a highly persistent phishing operation dubbed ZipLine, which targets primarily U.S.-based manufacturing firms in supply chain-critical sectors and delivers in-memory MixShell malware after a prolonged social engineering sequence. The campaign begins with AI-themed phishing emails and uses abused platforms such as Heroku to host dynamic content, while the infection chain deploys a ZIP file containing lure documents and a malicious LNK shortcut that executes a PowerShell loader.

MixShell is a custom shellcode-based backdoor that performs in-memory execution, uses XOR-encrypted configuration data, and relies on DNS TXT tunneling with HTTP fallback for C2 communications, formatting subdomains in a specific hex-encoded pattern. Persistence is achieved through TypeLib hijacking and a registry CLSID modification to relaunch the payload, with Capabilities including file operations, command execution via pipes, and reverse proxying for network pivoting.

Victimology spans industrial manufacturing, semiconductors, biotech, and energy sectors, with over 80% U.S.-focused, and defenders are advised to monitor extended email correspondences, inbound forms, and DNS anomalies as part of detection. According to Check Point Harmony Email & Collaboration, AI-driven analysis supports threat emulation to thwart such multi-stage threats.