Loading story…
Russian-aligned threat actor Curly COMrades (also tracked as KTA487) has adopted advanced techniques to evade endpoint detection and response (EDR) solutions by leveraging Microsoft Hyper-V virtualization. Attackers deploy hidden Alpine Linux virtual machines within compromised Windows hosts, running custom reverse shells and proxies that operate outside the visibility of traditional security tools. This approach allows malicious traffic to be NAT-translated through the legitimate host IP, achieving a high degree of stealth and persistence, and represents a significant evolution in threat actor tradecraft targeting enterprise environments.
Security researchers, including Bitdefender and Kroll, have documented these tactics as part of a broader trend in which sophisticated actors exploit legitimate system features to bypass commodity security controls. The use of architectural isolation, rather than direct engagement with EDR, signals a shift in adversary strategy and highlights the need for defenders to monitor for virtualization abuse and anomalous Hyper-V activity on endpoints. The campaign was first observed in July 2025 and publicly disclosed in November 2025, underscoring the ongoing risk to organizations relying solely on traditional endpoint security measures.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
Initial story creation
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Curly COMrades, a threat actor aligned with Russian geopolitical interests, has been observed leveraging Microsoft's Hyper-V hypervisor to deploy hidden Alpine Linux-based virtual machines on compromised Windows systems. By enabling Hyper-V via the DISM command-line tool and disabling its graphical management interface, the attackers create a concealed environment to run malware payloads such as CurlyShell and CurlyCat, evading detection by traditional endpoint security tools. The malicious VM is configured to use the Default Switch network adaptor, ensuring that all outbound traffic appears to originate from the legitimate host machine, further complicating detection and response efforts. This technique allows the threat actors to operate outside the visibility of the host operating system, making it difficult for defenders to identify malicious activity. The campaign, first observed in July 2025, highlights a growing trend of sophisticated evasion tactics that blend virtualization technology with advanced persistence mechanisms. Victim identities have not been publicly disclosed, but the method demonstrates a significant escalation in the use of virtualization for stealthy cyber operations targeting Windows environments.
Jun 29, 2026
The Russian-linked threat group Curly COMrades has been observed leveraging Microsoft's Hyper-V hypervisor on compromised Windows systems to deploy a concealed Alpine Linux-based virtual machine. This hidden VM, occupying only 120MB of disk space and 256MB of memory, is used to host custom malware tools including the CurlyShell reverse shell and the CurlCat reverse proxy, enabling the attackers to bypass traditional endpoint detection and response (EDR) solutions. By isolating their malicious operations within the VM, the group effectively evades host-based security monitoring, allowing for persistent network access and covert command execution. Bitdefender, in collaboration with the Georgian Computer Emergency Response Team (CERT), uncovered this campaign, which began in July after Curly COMrades gained remote access to victim machines and enabled Hyper-V while disabling its management interface. The group has previously targeted government and judicial bodies in Georgia and energy firms in Moldova, with this latest operation further demonstrating their use of legitimate virtualization technologies to facilitate espionage and maintain operational stealth. The VM's network traffic is routed through the host's stack using Hyper-V's internal networking, further complicating detection by standard security tools.
Jun 29, 2026
Threat actors are increasingly abusing **QEMU** to launch hidden virtual machines on compromised Windows hosts, allowing credential theft, reconnaissance, command-and-control, data staging, and ransomware preparation to occur outside the visibility of many endpoint security tools. Sophos linked one campaign, **STAC4713**, to **GOLD ENCOUNTER** and the **PayoutsKing** ransomware operation, where attackers gained access through exposed SonicWall VPNs without MFA and exploitation of **SolarWinds Web Help Desk** `CVE-2025-26399`, then created a SYSTEM-level scheduled task such as **TPMProfiler** to start `qemu-system-x86_64.exe`, boot a disguised Alpine Linux virtual disk, and establish reverse SSH tunnels for covert access. Researchers said the hidden VM hosted tooling including **AdaptixC2**, **Chisel**, **Rclone**, and **wg-obfuscator**, enabling stealthy persistence and exfiltration while leaving limited forensic evidence on the host. A second campaign, **STAC3725**, exploited **CitrixBleed2** `CVE-2025-5777`, installed a malicious **ScreenConnect** client, created a rogue local administrator account, and used a QEMU-based VM to assemble offensive tooling such as **Impacket**, **BloodHound.py**, **Kerbrute**, **KrbRelayX**, **NetExec**, and **Metasploit** for post-compromise operations. Reporting also noted broader initial-access methods, including phishing and fake Microsoft Teams IT-support lures, and warned that adversaries may shift between QEMU and other virtualization or sideloading techniques while keeping the same objective of stealthy intrusion and ransomware enablement. Defenders were urged to hunt for unauthorized QEMU installations, suspicious SYSTEM scheduled tasks, unusual SSH tunneling or port forwarding, disguised virtual disk images, and related indicators including the domain **vtps.us**, while prioritizing MFA and patching for `CVE-2025-26399` and `CVE-2025-5777`.
Jun 29, 2026