The menace actor generally known as Curly COMrades has been noticed exploiting virtualization applied sciences as a option to bypass security options and execute customized malware.
In response to a brand new report from Bitdefender, the adversary is alleged to have enabled the Hyper-V function on chosen sufferer methods to deploy a minimalistic, Alpine Linux-based digital machine.
“This hidden surroundings, with its light-weight footprint (solely 120MB disk house and 256MB reminiscence), hosted their customized reverse shell, CurlyShell, and a reverse proxy, CurlCat,” security researcher Victor Vrabie, together with Adrian Schipor and Martin Zugec, mentioned in a technical report.
Curly COMrades was first documented by the Romanian cybersecurity vendor in August 2025 in reference to a collection of assaults focusing on Georgia and Moldova. The exercise cluster is assessed to be lively since late 2023, working with pursuits which are aligned with Russia.
These assaults had been discovered to deploy instruments like CurlCat for bidirectional knowledge switch, RuRat for persistent distant entry, Mimikatz for credential harvesting, and a modular .NET implant dubbed MucorAgent, with early iterations courting again all the best way to November 2023.
In a follow-up evaluation carried out in collaboration with Georgia CERT, extra tooling related to the menace actor has been recognized, alongside makes an attempt to determine long-term entry by weaponizing Hyper-V on compromised Home windows 10 hosts to arrange a hidden distant working surroundings.
“By isolating the malware and its execution surroundings inside a VM, the attackers successfully bypassed many conventional host-based EDR detections,” the researchers mentioned. “The menace actor demonstrated a transparent willpower to take care of a reverse proxy functionality, repeatedly introducing new tooling into the surroundings.”
Moreover utilizing Resocks, Rsockstun, Ligolo-ng, CCProxy, Stunnel, and SSH-based strategies for proxy and tunneling, Curly COMrades has employed varied different instruments, together with a PowerShell script designed for distant command execution and CurlyShell, a beforehand undocumented ELF binary deployed within the digital machine that gives a persistent reverse shell.
Written in C++, the malware is executed as a headless background daemon to connect with a command-and-control (C2) server and launch a reverse shell, permitting the menace actors to run encrypted instructions. Communication is achieved by way of HTTP GET requests to ballot the server for brand new instructions and utilizing HTTP POST requests to transmit the outcomes of the command execution again to the server.
“Two customized malware households – CurlyShell and CurlCat – had been on the middle of this exercise, sharing a largely an identical code base however diverging in how they dealt with acquired knowledge: CurlyShell executed instructions straight, whereas CurlCat funneled visitors by SSH,” Bitdefender mentioned. “These instruments had been deployed and operated to make sure versatile management and adaptableness.”
