Pro-Russian Hackers Use Linux VMs to Hide in Windows

A threat actor known as Curly COMrades is using Linux-based virtual machines to remain undetected in Windows environments while pursuing Russia-aligned activities, according to Bitdefender. The research, conducted in collaboration with Georgian CERT, describes how the group establishes hidden, long‑term persistence by deploying a lightweight Alpine Linux VM (about 120MB disk space and 256MB memory) on victim devices to host their reverse shell, CurlyShell, and a reverse proxy, CurlCat.

This setup helps the attackers bypass many endpoint detection and response tools because traffic appears to originate from the legitimate host, with C2 communication and traffic obfuscation handled within the VM. Two PowerShell scripts were also found: one to inject a Kerberos ticket into LSASS for remote authentication, and another to create a local account across domain-joined machines to aid persistence.

Bitdefender’s technical solutions director, Martin Zugec, said the techniques represent an evolution in attacker tactics, emphasising long-term covert access rather than disruption or financial gain.