Curly COMrades Exploit Hyper-V for Covert Cyberespionage

The Russian APT group Curly COMrades is exploiting Microsoft's Hyper-V to create hidden Alpine Linux-based virtual machines on compromised Windows 10 systems. This tactic allows them to evade endpoint security measures and maintain persistent access to victim networks, utilizing custom malware tools like CurlyShell and CurlCat. The investigation was conducted by Bitdefender in collaboration with the Georgian CERT.