Hackers Weaponize Windows Hyper-V to Hide Linux VM and Evade EDR Detection

According to Bitdefender, the threat actor known as Curly COMrades has been observed exploiting virtualization technologies to bypass security solutions and run custom malware. The group enabled the Hyper-V role on selected victim systems to deploy a minimal Alpine Linux-based virtual machine that hosts their reverse shell CurlyShell and a reverse proxy CurlCat. The hidden environment is described as lightweight, with 120MB of disk space and 256MB of memory.

Researchers note that isolating the malware and its execution environment within a VM helps bypass many traditional host-based EDR detections, while the actors maintain a reverse proxy capability and continually introduce new tooling. The activity cluster is said to have been active since late 2023, with early documentation by a Romanian vendor in August 2025; the group’s interests are said to be aligned with Russia, and its campaigns have targeted Georgia and Moldova.

Tools associated with Curly COMrades include CurlCat, RuRat, Mimikatz, and a modular .NET implant named MucorAgent, with a headless C++ daemon for C2 communication.