Loading story…
Curly COMrades, a threat actor aligned with Russian geopolitical interests, has been observed leveraging Microsoft's Hyper-V hypervisor to deploy hidden Alpine Linux-based virtual machines on compromised Windows systems. By enabling Hyper-V via the DISM command-line tool and disabling its graphical management interface, the attackers create a concealed environment to run malware payloads such as CurlyShell and CurlyCat, evading detection by traditional endpoint security tools. The malicious VM is configured to use the Default Switch network adaptor, ensuring that all outbound traffic appears to originate from the legitimate host machine, further complicating detection and response efforts.
This technique allows the threat actors to operate outside the visibility of the host operating system, making it difficult for defenders to identify malicious activity. The campaign, first observed in July 2025, highlights a growing trend of sophisticated evasion tactics that blend virtualization technology with advanced persistence mechanisms. Victim identities have not been publicly disclosed, but the method demonstrates a significant escalation in the use of virtualization for stealthy cyber operations targeting Windows environments.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
9 events from the most recent confirmed update back to the earliest known activity.
A new malware evasion approach using Hyper-V virtual machines was highlighted in reporting around November 2025, showing how attackers can use virtualization to hinder analysis and detection.
Malware research published in early November 2025 also covered newer detection approaches intended to improve defenders' ability to identify increasingly sophisticated malware families and techniques.
By early November 2025, reporting drew attention to ongoing malware operations associated with North Korean threat actors Kimsuky and Lazarus, underscoring their continued operational tempo.
Researchers reported malicious NuGet packages containing logic bombs designed to activate years after installation, demonstrating a long-dwell software supply-chain threat.
Threat intelligence reporting in early November 2025 described newly identified Android malware strains focused on banking theft and mobile surveillance, showing continued evolution in mobile threats.
Researchers disclosed that certain Visual Studio Code extensions were malicious and included functionality that could enable ransomware-style impact on infected systems.
Malware reporting in early November 2025 noted a renewed wave of Gootloader activity, indicating the malware family had re-emerged as an active threat in current campaigns.
By early November 2025, researchers reported a campaign using weaponized military-themed documents to infect defense-sector targets with an advanced backdoor combining SSH access and Tor-based communications.
By early November 2025, malware research highlighted a newly observed backdoor dubbed SesameOp that used the OpenAI Assistants API as part of its command-and-control communications, reflecting a novel abuse of AI infrastructure.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
thehackernews.com
Open sourcesecurityaffairs.com
Open sourcesecurityaffairs.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The Russian-linked threat group Curly COMrades has been observed leveraging Microsoft's Hyper-V hypervisor on compromised Windows systems to deploy a concealed Alpine Linux-based virtual machine. This hidden VM, occupying only 120MB of disk space and 256MB of memory, is used to host custom malware tools including the CurlyShell reverse shell and the CurlCat reverse proxy, enabling the attackers to bypass traditional endpoint detection and response (EDR) solutions. By isolating their malicious operations within the VM, the group effectively evades host-based security monitoring, allowing for persistent network access and covert command execution. Bitdefender, in collaboration with the Georgian Computer Emergency Response Team (CERT), uncovered this campaign, which began in July after Curly COMrades gained remote access to victim machines and enabled Hyper-V while disabling its management interface. The group has previously targeted government and judicial bodies in Georgia and energy firms in Moldova, with this latest operation further demonstrating their use of legitimate virtualization technologies to facilitate espionage and maintain operational stealth. The VM's network traffic is routed through the host's stack using Hyper-V's internal networking, further complicating detection by standard security tools.
Jun 29, 2026
Russian-aligned threat actor Curly COMrades (also tracked as KTA487) has adopted advanced techniques to evade endpoint detection and response (EDR) solutions by leveraging Microsoft Hyper-V virtualization. Attackers deploy hidden Alpine Linux virtual machines within compromised Windows hosts, running custom reverse shells and proxies that operate outside the visibility of traditional security tools. This approach allows malicious traffic to be NAT-translated through the legitimate host IP, achieving a high degree of stealth and persistence, and represents a significant evolution in threat actor tradecraft targeting enterprise environments. Security researchers, including Bitdefender and Kroll, have documented these tactics as part of a broader trend in which sophisticated actors exploit legitimate system features to bypass commodity security controls. The use of architectural isolation, rather than direct engagement with EDR, signals a shift in adversary strategy and highlights the need for defenders to monitor for virtualization abuse and anomalous Hyper-V activity on endpoints. The campaign was first observed in July 2025 and publicly disclosed in November 2025, underscoring the ongoing risk to organizations relying solely on traditional endpoint security measures.
Jul 10, 2026
Threat actors are increasingly abusing **QEMU** to launch hidden virtual machines on compromised Windows hosts, allowing credential theft, reconnaissance, command-and-control, data staging, and ransomware preparation to occur outside the visibility of many endpoint security tools. Sophos linked one campaign, **STAC4713**, to **GOLD ENCOUNTER** and the **PayoutsKing** ransomware operation, where attackers gained access through exposed SonicWall VPNs without MFA and exploitation of **SolarWinds Web Help Desk** `CVE-2025-26399`, then created a SYSTEM-level scheduled task such as **TPMProfiler** to start `qemu-system-x86_64.exe`, boot a disguised Alpine Linux virtual disk, and establish reverse SSH tunnels for covert access. Researchers said the hidden VM hosted tooling including **AdaptixC2**, **Chisel**, **Rclone**, and **wg-obfuscator**, enabling stealthy persistence and exfiltration while leaving limited forensic evidence on the host. A second campaign, **STAC3725**, exploited **CitrixBleed2** `CVE-2025-5777`, installed a malicious **ScreenConnect** client, created a rogue local administrator account, and used a QEMU-based VM to assemble offensive tooling such as **Impacket**, **BloodHound.py**, **Kerbrute**, **KrbRelayX**, **NetExec**, and **Metasploit** for post-compromise operations. Reporting also noted broader initial-access methods, including phishing and fake Microsoft Teams IT-support lures, and warned that adversaries may shift between QEMU and other virtualization or sideloading techniques while keeping the same objective of stealthy intrusion and ransomware enablement. Defenders were urged to hunt for unauthorized QEMU installations, suspicious SYSTEM scheduled tasks, unusual SSH tunneling or port forwarding, disguised virtual disk images, and related indicators including the domain **vtps.us**, while prioritizing MFA and patching for `CVE-2025-26399` and `CVE-2025-5777`.
Jun 29, 2026