Cyber-Espionage Group Uses Hyper-V for Stealthy Attacks

A cyber-espionage group known as Curly COMrades has been leveraging Microsoft Hyper-V virtualization to establish stealthy, persistent access within compromised networks. The group uses a lightweight Alpine Linux virtual machine to host custom malware, CurlyShell and CurlCat, which operate within a virtualized enclave invisible to host-based endpoint detection and response (EDR) tools. The attackers also rely on PowerShell scripts for persistence and lateral movement, including a custom Kerberos Ticket Injector script. The investigation was conducted in collaboration with a national CERT, which provided critical evidence from a compromised web server used as a proxy for the attacker's C2 infrastructure.