Pro-Russian group Curly COMrades used virtual machines to compromise systems

Cybersecurity company Bitdefender published a report on November 4, 2025, detailing the new modus operandi of Curly COMrades, a pro-Russian APT group targeting organizations in Eastern Europe, first identified in August 2025. Researchers documented a campaign exploiting Microsoft Hyper-V virtualization functionality on Windows systems.

Curly COMrades took control of Hyper-V by disabling its management interface, allowing them to deploy a lightweight Linux Alpine virtual environment on the target machine. Within this environment, the attackers installed two malware tools, CurlyShell and CurlCat, enabling them to execute remote commands while remaining undetectable within network traffic.

This strategy reportedly allowed Curly COMrades to evade “numerous detection tools.” Bitdefender researchers did not specify which organizations were targeted but indicated that they had collaborated with the Georgian CERT, which initially discovered a CurlCat sample on a network.