CurlCat

CurlCat is a custom ELF malware implant used by the Curly COMrades espionage cluster, which Bitdefender assesses as aligned with Russian geopolitical interests. It is a libcurl-based companion implant to CurlyShell and is primarily used for traffic tunneling rather than command execution. Multiple reports describe it as a netcat-like reverse proxy or relay that facilitates bidirectional data transfer between STDIN/STDOUT and a command-and-control server over HTTPS, and as a payload used to manage SSH reverse proxy tunnels.

In the observed tradecraft, CurlCat was deployed inside a lightweight Alpine Linux virtual machine imported onto compromised Windows 10 systems through abuse of Microsoft Hyper-V. The VM used Hyper-V Default Switch/NAT so outbound traffic appeared to originate from the victim host IP, helping evade host-based EDR visibility. CurlCat was located at /root/updater in the VM, had MD5 1a6803d9a2110f86bb26fcfda3606302, and did not maintain persistence itself; instead, it was launched on demand via the CurlyShell channel. The malware wrapped outgoing SSH traffic into standard HTTP request payloads, allowing covert tunneling through compromised legitimate websites used as relays/proxies. Investigators also noted that the sample was configured to disable TLS certificate verification, enabling arbitrary certificates on relay servers.

CurlCat and CurlyShell share a largely identical C++ code base built around libcurl, but differ in handling received data: CurlyShell executes commands directly, while CurlCat funnels traffic through SSH. The malware used a custom Base64 substitution alphabet/non-standard Base64 encoding for evasion. Reporting links CurlCat to operations targeting judicial and government entities in Georgia and an energy distribution company in Moldova, and more broadly to post-compromise host-based tradecraft associated with Curly COMrades.