Curly COMrades Exploit Windows Hyper-V to Conceal Linux Malware and Evade Enterprise EDR Systems

Curly COMrades Exploit Windows Hyper-V to Conceal Linux Malware and Evade Enterprise EDR Systems

A newly surfaced attack campaign from the threat group Curly COMrades is taking virtualization abuse to the next level — using Windows Hyper-V to spin up hidden Linux virtual machines and deploy stealth malware that bypasses traditional endpoint detection and response (EDR) systems.

The sophisticated method, detailed by Bitdefender researchers, marks one of the most advanced examples yet of virtualization-based evasion on compromised enterprise systems.

🧠 The Attack: Turning Hyper-V Into a Covert Malware Host

Curly COMrades, an actor with operations aligning with Russian state interests, has been observed enabling the Windows Hyper-V role on select infected endpoints to quietly install an Alpine Linux-based virtual machine — a lightweight environment consuming just 120MB of disk space and 256MB of memory.

Inside this micro-VM, the attackers deployed two core tools:

• CurlyShell — a custom reverse shell for encrypted command execution.

• CurlCat — a reverse proxy enabling bidirectional traffic flow to external command-and-control (C2) servers.

By isolating their malicious components inside a virtualized Linux instance, the attackers effectively hid their payloads from host-level security tools, including EDR and antivirus solutions running on Windows.

“This hidden environment allowed them to execute malware completely out of sight,” Bitdefender’s research team noted. “EDR agents monitoring the host OS could no longer observe the malicious activity occurring inside the VM.”

🧩 Toolset and Tactics

Active since late 2023, Curly COMrades has been linked to espionage and cyber operations targeting Eastern Europe, primarily Georgia and Moldova.

Their arsenal includes:

• CurlCat – Reverse proxy for encrypted C2 communications

• CurlyShell – Custom ELF binary reverse shell (C++)

• RuRat – Remote access Trojan for persistence

• Mimikatz – Credential extraction

• MucorAgent – Modular .NET-based implant for lateral movement

Follow-up investigations by Georgia’s CERT confirmed that the group’s operators used Hyper-V on compromised Windows 10 systems to create hidden remote workspaces, sustaining long-term access to victim networks.

🧠 Bypassing Detection Through Virtualization

This approach showcases a new frontier in stealth malware operations:
By isolating command execution and persistence layers within a sandboxed Linux VM, the attackers neutralize most EDR telemetry, as host-level sensors cannot see activity occurring “beyond the hypervisor boundary.”

The group leveraged a mix of tunneling and proxy tools — including Resocks, Ligolo-ng, CCProxy, Stunnel, and SSH-based relay mechanisms — to maintain outbound communication while appearing legitimate at the network layer.

The result is a hybrid threat architecture — Windows as the entry point, Linux as the hidden operations base.

⚙️ Custom Malware: CurlyShell and CurlCat

Both malware families share similar codebases but diverge in purpose:

• CurlyShell executes attacker-issued commands directly, maintaining continuous communication with the C2 infrastructure via HTTP GET/POST polling.

• CurlCat routes encrypted traffic through SSH tunnels, granting operators flexible proxy control and lateral movement across internal systems.

Together, they form a modular and resilient control framework, allowing Curly COMrades to maintain persistent access, adapt to environmental changes, and evade detection for extended periods.

🚨 Elliptic Systems’ Analysis

This campaign underscores an alarming evolution in cyber operations — the weaponization of built-in enterprise tools like Hyper-V to create hidden, self-contained malware ecosystems.

By leveraging virtualization as an evasion layer, attackers are essentially building a second, invisible operating system inside corporate environments.

Elliptic Systems’ assessment:

“We are witnessing a shift from malware evasion to malware virtualization — where attackers use legitimate infrastructure to hide in plain sight.”

🛡️ Elliptic Systems’ Recommendations

To defend against virtualization-based stealth threats:

✅ Audit Hyper-V and virtualization roles across all enterprise endpoints.
✅ Restrict administrative privileges to prevent attackers from enabling Hyper-V or similar hypervisors.
✅ Deploy behavior-based EDR capable of monitoring hypervisor API calls and virtual disk creation.
✅ Log all virtualization events in Windows Event Viewer and SIEMs for anomaly detection.
✅ Segment management networks and monitor for unauthorized VMs or hidden compute environments.

As cyber operations become increasingly sophisticated, defenders must expand visibility beyond the operating system — into the virtualized layers attackers now inhabit.