Curly COMrades APT Bypasses EDR by Hiding Linux Backdoor Inside Covert Hyper-V VM

According to Bitdefender, in collaboration with the Georgian CERT, researchers uncovered a new wave of cyber-espionage activity by a Russian-aligned threat group known as Curly COMrades that uses Microsoft Hyper-V to establish stealthy, persistent access within compromised networks. The campaign began in July 2025 and targets organisations in Eastern Europe and the Caucasus, representing a major escalation in the use of virtualised malware environments to evade detection.

Bitdefender’s analysis shows that the group enabled the Hyper-V role on selected Windows 10 hosts and deployed a lightweight Alpine Linux VM acting as a covert command-and-control hub, with a footprint of about 120MB disk space and 256MB memory. Inside the VM, two custom malware families—CurlyShell and CurlCat—provide a persistent reverse shell and traffic tunnelling through a reverse proxy, using non-standard Base64 to disguise network traffic.

The attackers also rely on PowerShell for persistence and lateral movement, including a Kerberos Ticket Injector script and a Group Policy–delivered script to create or reset local user accounts for long-term access.