Curly COMrades Hacker Group Deploys New Tools for Stealthy Remote Access on Compromised Windows 10 Systems

A sophisticated threat actor known as Curly COMrades has demonstrated advanced evasion by using Hyper-V on Windows 10 to host a minimal Alpine Linux‑based virtual machine containing their custom malware, creating a covert, long‑term foothold while the host remains under the radar.

According to Georgian CERT under the Operative-Technical Agency of Georgia, the campaign exploits Hyper-V to route malicious traffic via NAT through the host’s network stack, making outbound communications appear to originate from the legitimate host IP.

In the virtual environment, two related implants—CurlyShell and CurlCat—share a C++ code base built around libcurl, with CurlyShell delivering a persistent reverse shell and CurlCat acting as a reverse proxy tunnel manager to cloak SSH traffic inside standard HTTP requests.

PowerShell is used for lateral movement, including a script at c:\programdata\kb_upd.ps1 that injects Kerberos tickets into LSASS to authenticate remotely, plus a RemoteWorker() function for post‑exploitation tasks, and another variant that creates persistent local domain accounts. A compromised site relays traffic and iptables rules point to attacker infrastructure at 88.198.91[.]116, highlighting the attackers’ use of legitimate system features to reduce detection risk.