Curly COMrades hides malware in a Hyper-V Alpine Linux VM to evade EDR
Technical Analysis
Summary
Hide ▲
Show ▼
Researchers identified Curly COMrades using Windows Hyper-V to hide a minimal Alpine Linux virtual machine on compromised Windows 10 hosts, a setup that can bypass host-based EDR and preserve remote control. The hidden guest ran CurlyShell and CurlCat, giving the operators a covert execution layer for commands and proxying. The technique matters because it turns a legitimate virtualization feature into a persistence and evasion mechanism.
Related Happenings
UNC6201 Dell RecoverPoint for Virtual Machines zero-day campaign
Campaign
H score44
First: 17.02.2026 22:15
Last: 17.02.2026 22:15
Sources 1
About this happening:
The UNC6201 campaign has been exploiting a Dell zero-day since mid-2024, creating a sustained risk of unauthorized access and stealthy movement across victims' virtual...
UNC6201 Dell RecoverPoint for Virtual Machines zero-day campaign
CampaignAbout this happening: The UNC6201 campaign has been exploiting a Dell zero-day since mid-2024, creating a sustained risk of unauthorized access and stealthy movement across victims' virtual...
Latest development: 19.02.2026 17:30
CISA added CVE-2026-22769 to its Known Exploited Vulnerabilities catalog and ordered Federal Civilian Executive Branch agencies to secure affected Dell RecoverPoint systems by Saturday, February 21, after Mandiant and Google Threat Intelligence Group (GTIG) said UNC6201 had exploited the flaw since at least mid-2024.
DEAD#VAX campaign using IPFS-hosted VHD phishing to deploy AsyncRAT
Campaign
H score33
First: 04.02.2026 19:24
Last: 04.02.2026 19:24
Sources 1
About this happening:
The DEAD#VAX campaign is using phishing-delivered IPFS-hosted VHD files to deploy AsyncRAT, creating a stealthier path to fileless endpoint compromise. The chain r...
DEAD#VAX campaign using IPFS-hosted VHD phishing to deploy AsyncRAT
CampaignAbout this happening: The DEAD#VAX campaign is using phishing-delivered IPFS-hosted VHD files to deploy AsyncRAT, creating a stealthier path to fileless endpoint compromise. The chain r...
Kraken ransomware HelloKitty-linked double-extortion campaign
Campaign
H score44
First: 14.11.2025 00:53
Last: 14.11.2025 00:53
Sources 1
About this happening:
Kraken ransomware is an active double-extortion campaign linked to the HelloKitty ecosystem and observed in August 2025 using SMB exploitation, Cloudflare...
Kraken ransomware HelloKitty-linked double-extortion campaign
CampaignAbout this happening: Kraken ransomware is an active double-extortion campaign linked to the HelloKitty ecosystem and observed in August 2025 using SMB exploitation, Cloudflare...
Akira ransomware Linux encryptor expands to Nutanix AHV VM disk encryption
Malware Activity
H score40
First: 14.11.2025 00:32
Last: 14.11.2025 00:32
Sources 1
About this happening:
The Akira ransomware operation has expanded its encryptor to Nutanix AHV VM disks, increasing the range of virtualized environments that can be encrypted during intrusions...
Akira ransomware Linux encryptor expands to Nutanix AHV VM disk encryption
Malware ActivityAbout this happening: The Akira ransomware operation has expanded its encryptor to Nutanix AHV VM disks, increasing the range of virtualized environments that can be encrypted during intrusions...
Storm-2603 Velociraptor-abuse ransomware campaign
Campaign
H score41
First: 09.10.2025 22:31
Last: 09.10.2025 22:31
Sources 1
About this happening:
The Storm-2603 campaign abuses Velociraptor as an intrusion enabler during ransomware attacks, using an outdated Velociraptor 0.73.4.0 instance vulnerable to CVE...
Storm-2603 Velociraptor-abuse ransomware campaign
CampaignAbout this happening: The Storm-2603 campaign abuses Velociraptor as an intrusion enabler during ransomware attacks, using an outdated Velociraptor 0.73.4.0 instance vulnerable to CVE...
Timeline
-
06.11.2025 09:22 2 articles · 8mo ago
Curly COMrades hides CurlyShell in Hyper-V Alpine Linux VM
Technical Analysis UpdateBitdefender reported that Curly COMrades enabled the Hyper-V role on compromised Windows 10 hosts to deploy a hidden Alpine Linux-based virtual machine that hosted CurlyShell and CurlCat. The minimal guest environment, described as using 120MB disk space and 256MB memory, let the operators run a persistent reverse shell, proxy traffic, and bypass many host-based EDR detections while keeping long-term access with tools such as Resocks, Rsockstun, Ligolo-ng, CCProxy, Stunnel, SSH-based methods, RuRat, Mimikatz, and MucorAgent.
Show sources
- Hackers Weaponize Windows Hyper-V to Hide Linux VM and Evade EDR Detection — thehackernews.com — 06.11.2025 09:22
- Hackers Weaponize Windows Hyper-V to Hide Linux VM and Evade EDR Detection — thehackernews.com — 06.11.2025 09:22