Alleged Russia-linked Curly COMrades exploit Windows Hyper-V to evade EDRs

Bitdefender researchers, aided by Georgia’s CERT, say Curly COMrades—a group linked to Russian interests— exploited Windows Hyper-V to hide Alpine Linux virtual machines and evade endpoint detection and response tools. The attackers created hidden VMs (120MB disk, 256MB memory) hosting custom tools such as CurlyShell and CurlCat to run covertly and bypass many traditional host-based EDR detections, with concealment enhanced by encrypting payloads and minimising forensic traces.

They maintained persistent, layered access by deploying tunnelling tools like Resocks, Ligolo-ng and Stunnel and using PowerShell scripts to exploit Kerberos tickets and Group Policy for persistence. The implants, CurlyShell and CurlCat, run headless as background daemons inside the hidden Hyper-V VMs and communicate via a custom non-standard Base64 scheme, generating a unique Base64-encoded session cookie used in a PHP-style C2 handshake; CurlyShell executes commands while CurlCat forwards data through SSH.

According to the report, Curly COMrades has been active since at least late 2023, and the group emphasises stealth by isolating their execution environment within a VM to further complicate detection.