Curly COMrades

Curly COMrades is a Russia-aligned cyber-espionage threat actor active since at least mid-2024 and assessed to operate in support of Russian geopolitical interests. The group has targeted government and judicial entities in Georgia and an energy distribution organization in Moldova, with operations focused on covert long-term access, credential theft, lateral movement, and selective data exfiltration. The actor is notable for combining living-off-the-land techniques, open-source tooling, legitimate remote administration software, and custom malware. A central malware family associated with the group is MucorAgent, a modular three-stage .NET backdoor that achieves stealthy persistence through COM/CLSID hijacking tied to .NET Native Image Generator task execution. MucorAgent can execute AES-encrypted PowerShell in memory without launching the standard PowerShell process, apply AMSI bypass techniques, and return command output through covert web-based channels. Curly COMrades has also used custom tunneling and access tools including CurlyShell, a persistent HTTPS reverse shell, and CurlCat, a reverse proxy that encapsulates SSH traffic in HTTP(S) to support covert pivoting. A defining tradecraft innovation attributed to Curly COMrades is abuse of Microsoft Hyper-V on compromised Windows systems to deploy a lightweight hidden Alpine Linux virtual machine. Malware execution inside this VM reduces visibility to host-based EDR/XDR products while allowing outbound traffic to appear as if it originates from the victim host through Hyper-V NAT networking. The group disguised the VM to blend with legitimate system components and used it as an isolated operational environment for persistence and command execution. Across intrusions, Curly COMrades has relied heavily on proxying and tunneling infrastructure, including Resocks, SOCKS-based tooling, SSH remote port forwarding, Stunnel, Ligolo-ng, and related relay mechanisms. The actor has used compromised legitimate websites as traffic relays for command-and-control and exfiltration, helping blend malicious traffic with normal web activity and complicate attribution. Persistence mechanisms have included scheduled tasks, Windows services, Group Policy-deployed scripts, and local account creation or password resets across domain-joined systems. Credential access is a major operational objective. Reported techniques include repeated attempts to extract the Active Directory database, LSASS dumping, DCSync activity, Kerberos ticket injection, and use of tools such as Mimikatz and other adapted credential-dumping utilities. Post-compromise activity has included remote command execution, Active Directory reconnaissance, staging of collected data, archival, and manual or low-frequency exfiltration. The actor has been described as overlapping in some respects with Russian-nexus activity, including reporting of overlap with Sandworm-linked tradecraft, but available evidence has been insufficient to conclusively merge Curly COMrades into an already established cluster. Curly COMrades remains tracked as a distinct espionage actor characterized by stealth-focused persistence, credential-centric post-exploitation, and virtualization-based defense evasion.