Threat actor
Curly COMrades
Russia
Tracked by CyberSIXT since 5 Nov 2025
- Articles · all time
- 3
- Articles · last 30 days
- 0
- CVEs exploited · attributed · all time
- 0
- Research reports · all time
- 0
4 articles from 3 outlets since 5 Nov 2025; the latest 313 days ago.
- Article
- First report
Show as table
| Published (UTC) | Outlet | Headline |
|---|---|---|
| Wed 17 Dec 2025 · 03:50 UTC | SecurityOnline | Sandworm’s Tactical Pivot: Russian GRU Abandons Zero-Days to Weaponize Misconfigured Edge Devices |
| Thu 6 Nov 2025 · 10:25 UTC | Security Affairs | Alleged Russia-linked Curly COMrades exploit Windows Hyper-V to evade EDRs |
| Thu 6 Nov 2025 · 01:40 UTC | SecurityOnline | Curly COMrades APT Bypasses EDR by Hiding Linux Backdoor Inside Covert Hyper-V VM |
| Wed 5 Nov 2025 · 07:46 UTC | GBHackers | Curly COMrades Hacker Group Deploys New Tools for Stealthy Remote Access on Compromised Windows 10 Systems |
Who reported 3 outlets
- SecurityOnline2
- GBHackers1
- Security Affairs1
Names and sources
- Curly COMrades
- Named by CyberSIXT coverage
- Curly COMrades
- Named by Malpedia · curly_comrades
- Curly COMrades
- Named by MISP Galaxy · 7bf6ae38-fcd3-4a99-99ba-292990a27f0a
- 7bf6ae38-fcd3-4a99-99ba-292990a27f0a
- Named by CyberSIXT coverage
Attributed facts
- origin
- Russia (MISP Galaxy · 7bf6ae38-fcd3-4a99-99ba-292990a27f0a)
- Sandworm’s Tactical Pivot: Russian GRU Abandons Zero-Days to Weaponize Misconfigured Edge DevicesSecurityOnline
- Alleged Russia-linked Curly COMrades exploit Windows Hyper-V to evade EDRsSecurity Affairs
- Curly COMrades APT Bypasses EDR by Hiding Linux Backdoor Inside Covert Hyper-V VMSecurityOnline
- Curly COMrades Hacker Group Deploys New Tools for Stealthy Remote Access on Compromised Windows 10 SystemsGBHackers · first in our coverage