Loading story…
The Russian-linked threat group Curly COMrades has been observed leveraging Microsoft's Hyper-V hypervisor on compromised Windows systems to deploy a concealed Alpine Linux-based virtual machine. This hidden VM, occupying only 120MB of disk space and 256MB of memory, is used to host custom malware tools including the CurlyShell reverse shell and the CurlCat reverse proxy, enabling the attackers to bypass traditional endpoint detection and response (EDR) solutions. By isolating their malicious operations within the VM, the group effectively evades host-based security monitoring, allowing for persistent network access and covert command execution.
Bitdefender, in collaboration with the Georgian Computer Emergency Response Team (CERT), uncovered this campaign, which began in July after Curly COMrades gained remote access to victim machines and enabled Hyper-V while disabling its management interface. The group has previously targeted government and judicial bodies in Georgia and energy firms in Moldova, with this latest operation further demonstrating their use of legitimate virtualization technologies to facilitate espionage and maintain operational stealth. The VM's network traffic is routed through the host's stack using Hyper-V's internal networking, further complicating detection by standard security tools.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
6 events from the most recent confirmed update back to the earliest known activity.
Following its investigation, Bitdefender released indicators of compromise and recommended monitoring for unusual Hyper-V activation, LSASS access, and suspicious GPO-delivered PowerShell activity. The guidance aimed to help defenders detect the VM-based tradecraft and related persistence mechanisms.
Bitdefender, working with the Georgian CERT, investigated the incidents and attributed the stealthy Hyper-V abuse to Curly COMrades. Their analysis detailed the malware, persistence methods, and VM-based evasion approach used in the espionage operation.
Inside the hidden Linux VM, the attackers ran the custom ELF implants CurlyShell and CurlCat to provide command execution, persistence, and covert tunneling or reverse-proxy access over HTTPS/SSH. The operation also used PowerShell-based persistence, Kerberos ticket injection into LSASS, and Group Policy to create local accounts across domains.
In the observed campaign, Curly COMrades enabled Hyper-V, disabled its management interface, and created a concealed Alpine Linux VM disguised as "WSL" on infected Windows machines. The VM used Hyper-V's Default Switch so malicious traffic blended with normal host network activity and evaded host-based EDR visibility.
The group compromised judicial and government bodies in Georgia as well as an energy company in Moldova. These intrusions formed the victim set later analyzed by Bitdefender and the Georgian CERT.
Bitdefender assessed Curly COMrades as a Russia-aligned espionage group active since mid-2024. Other reporting indicates the Hyper-V-focused targeting of Windows systems was observed from July 2025, showing the campaign was already underway before public disclosure.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
9 references tracked. Mallory keeps watching after this page renders.
thehackernews.com
Open sourcesecurityonline.info
Open sourcesecurityaffairs.com
Open sourcescworld.com
Open sourcetherecord.media
Open sourcecsoonline.com
Open sourcetheregister.com
Open sourcego.theregister.com
Open sourcebleepingcomputer.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Curly COMrades, a threat actor aligned with Russian geopolitical interests, has been observed leveraging Microsoft's Hyper-V hypervisor to deploy hidden Alpine Linux-based virtual machines on compromised Windows systems. By enabling Hyper-V via the DISM command-line tool and disabling its graphical management interface, the attackers create a concealed environment to run malware payloads such as CurlyShell and CurlyCat, evading detection by traditional endpoint security tools. The malicious VM is configured to use the Default Switch network adaptor, ensuring that all outbound traffic appears to originate from the legitimate host machine, further complicating detection and response efforts. This technique allows the threat actors to operate outside the visibility of the host operating system, making it difficult for defenders to identify malicious activity. The campaign, first observed in July 2025, highlights a growing trend of sophisticated evasion tactics that blend virtualization technology with advanced persistence mechanisms. Victim identities have not been publicly disclosed, but the method demonstrates a significant escalation in the use of virtualization for stealthy cyber operations targeting Windows environments.
Jun 29, 2026
Russian-aligned threat actor Curly COMrades (also tracked as KTA487) has adopted advanced techniques to evade endpoint detection and response (EDR) solutions by leveraging Microsoft Hyper-V virtualization. Attackers deploy hidden Alpine Linux virtual machines within compromised Windows hosts, running custom reverse shells and proxies that operate outside the visibility of traditional security tools. This approach allows malicious traffic to be NAT-translated through the legitimate host IP, achieving a high degree of stealth and persistence, and represents a significant evolution in threat actor tradecraft targeting enterprise environments. Security researchers, including Bitdefender and Kroll, have documented these tactics as part of a broader trend in which sophisticated actors exploit legitimate system features to bypass commodity security controls. The use of architectural isolation, rather than direct engagement with EDR, signals a shift in adversary strategy and highlights the need for defenders to monitor for virtualization abuse and anomalous Hyper-V activity on endpoints. The campaign was first observed in July 2025 and publicly disclosed in November 2025, underscoring the ongoing risk to organizations relying solely on traditional endpoint security measures.
Jul 10, 2026
Threat actors are increasingly abusing **QEMU** to launch hidden virtual machines on compromised Windows hosts, allowing credential theft, reconnaissance, command-and-control, data staging, and ransomware preparation to occur outside the visibility of many endpoint security tools. Sophos linked one campaign, **STAC4713**, to **GOLD ENCOUNTER** and the **PayoutsKing** ransomware operation, where attackers gained access through exposed SonicWall VPNs without MFA and exploitation of **SolarWinds Web Help Desk** `CVE-2025-26399`, then created a SYSTEM-level scheduled task such as **TPMProfiler** to start `qemu-system-x86_64.exe`, boot a disguised Alpine Linux virtual disk, and establish reverse SSH tunnels for covert access. Researchers said the hidden VM hosted tooling including **AdaptixC2**, **Chisel**, **Rclone**, and **wg-obfuscator**, enabling stealthy persistence and exfiltration while leaving limited forensic evidence on the host. A second campaign, **STAC3725**, exploited **CitrixBleed2** `CVE-2025-5777`, installed a malicious **ScreenConnect** client, created a rogue local administrator account, and used a QEMU-based VM to assemble offensive tooling such as **Impacket**, **BloodHound.py**, **Kerbrute**, **KrbRelayX**, **NetExec**, and **Metasploit** for post-compromise operations. Reporting also noted broader initial-access methods, including phishing and fake Microsoft Teams IT-support lures, and warned that adversaries may shift between QEMU and other virtualization or sideloading techniques while keeping the same objective of stealthy intrusion and ransomware enablement. Defenders were urged to hunt for unauthorized QEMU installations, suspicious SYSTEM scheduled tasks, unusual SSH tunneling or port forwarding, disguised virtual disk images, and related indicators including the domain **vtps.us**, while prioritizing MFA and patching for `CVE-2025-26399` and `CVE-2025-5777`.
Jun 29, 2026