CyberHappenings logo
☰
Home Browse About

Track cybersecurity events as they unfold. Sourced timelines. Filter, sort, and browse. Fast, privacy‑respecting. No invasive ads, no tracking.

Curly COMrades Use Hyper-V to Hide Linux VM and Evade EDR Detection

First reported
Last updated
1 unique sources, 1 articles

Summary

Hide ▲

The threat actor Curly COMrades has been observed using Windows Hyper-V to deploy a minimalistic Alpine Linux-based virtual machine. This VM hosts custom malware, including CurlyShell and CurlCat, to evade EDR detection and maintain persistent access. The attacks target Georgia and Moldova, with activity dating back to late 2023. The adversary uses various tools for data transfer, remote access, credential harvesting, and command execution. The hidden VM environment, with a lightweight footprint, allows the threat actor to bypass traditional security solutions and maintain a reverse proxy capability.

Timeline

  1. 06.11.2025 09:22 1 articles · 4d ago

    Curly COMrades Deploy Hyper-V-Based Linux VM to Evade Detection

    Curly COMrades has been observed using Windows Hyper-V to deploy a minimalistic Alpine Linux-based VM. This VM hosts custom malware, including CurlyShell and CurlCat, to evade EDR detection and maintain persistent access. The attacks target Georgia and Moldova, with activity dating back to late 2023. The adversary uses various tools for data transfer, remote access, credential harvesting, and command execution. The hidden VM environment allows the threat actor to bypass traditional security solutions and maintain a reverse proxy capability.

    Show sources
    Open in new tab

Information Snippets