A Russia-aligned hacking group known as ‘Curly COMrades’ has been using Microsoft’s Hyper-V virtualization in Windows to hide malware inside Alpine Linux virtual machines, allowing the threat actors to bypass host-based endpoint detection and response (EDR) controls, according to research conducted by cybersecurity firm Bitdefender and the Georgian CERT.
The attackers deployed two custom tools: a reverse shell for remote command execution called ‘CurlyShell,’ and CurlCat, a reverse proxy used for covert communication.
“The attackers enabled the Hyper-V role on selected victim systems to deploy a minimalistic, Alpine Linux-based virtual machine. This hidden environment, with its lightweight footprint (only 120MB disk space and 256MB memory), hosted their custom reverse shell, CurlyShell, and a reverse proxy, CurlCat,” the researchers said.
The group, believed to have been active since mid-2024, is aligned with Russian geopolitical interests and has previously targeted government and judicial bodies in Georgia as well as energy companies in Moldova.
According to the researchers, Curly COMrades gained remote access to victim machines and enabled Hyper-V before disabling its management interface to conceal the virtual environment.
To further hide their tracks, the attackers named the virtual machine “WSL”, mimicking the Windows Subsystem for Linux, and routed all malicious traffic through the host’s legitimate network connection. This made the outbound communication appear as if it originated from the infected system’s own IP address.
The group also relied on PowerShell scripts for persistence and lateral movement. One of the scripts injected Kerberos tickets to authenticate on remote systems, while another created local accounts across domain machines via Group Policy.
“The threat actor demonstrated a clear determination to maintain a reverse proxy capability, repeatedly introducing new tooling into the environment. Artifacts identified included a wide array of proxy and tunneling samples, such as Resocks, Rsockstun, Ligolo-ng, CCProxy, Stunnel, and SSH-based methods,” the report noted.
