US EditionRussian Spies Pack Custom Malware Into Hidden VMs on Windows
Curly COMrades exploited Hyper-V to hide malware in Alpine Linux VMs, bypassing endpoint detection and response on Windows systems since mid-2024, researchers found.
- Curly COMrades abused Microsoft Hyper-V to deploy a minimal Alpine Linux VM hosting CurlyShell and CurlCat implants for command execution and proxying.
- Bitdefender, Romanian cybersecurity firm, and the Georgian Computer Emergency Response Team uncovered this campaign, tracking Curly COMrades since mid-2024 with activities aligning to Russian geopolitical interests but no direct government link.
- After gaining remote access, the attackers enabled Hyper-V on two machines, disabled its management interface, named the VM 'WSL', used the Default Switch network adapter, and deployed PowerShell scripts for Kerberos ticket injection into LSASS and Group Policy persistence mechanism.
- Vrabie wrote that by isolating malware in a VM, attackers bypassed host-based EDRs, and Bitdefender explained malicious outbound traffic appears from the host IP with SSH-over-HTTP wrapping.
- Researchers recommend a multi-layered, defense-in-depth strategy as Bitdefender and other security experts highlight encrypted embedded payloads and PowerShell abuse leave minimal forensic traces amid fragmented security-tool coverage.
16 Articles
16 Articles
Virtual Shadows: How Russian Hackers Hide Malware in Linux VMs on Windows
In the ever-evolving cat-and-mouse game of cybersecurity, a sophisticated new tactic has emerged from Russian state-aligned hackers. Dubbed ‘Curly COMrades’ by researchers, this group is exploiting Microsoft’s Hyper-V virtualization technology to embed hidden Linux virtual machines within compromised Windows systems. This method allows them to run custom malware undetected, bypassing traditional endpoint detection and response (EDR) tools. The t…
Global Security Mag Online
Global Security Mag OnlineThanks to the cooperation of the Georgian CERT, Bitdefender has identified a second advanced campaign by the Russian-affiliated APT Curly COMrades Group, which is abusing Hyper-V virtualization to establish hidden operational environments and maintain persistent access. Bitdefender's continued investigation of the Curly COMrades Group - already documented for the first time in August 2025 - reveals the new tools and techniques used by the Russia…
Coverage Details
Bias Distribution
- 100% of the sources are Center
Factuality
To view factuality data please Upgrade to Premium
