CurlyShell

CurlyShell is a custom, previously undocumented ELF implant used by the Russia-aligned threat actor Curly COMrades and reported as overlapping with broader GRU/Sandworm-linked activity. It is a C++ malware family built around libcurl and deployed inside a lightweight Alpine Linux virtual machine that attackers hide on compromised Windows 10 systems by enabling Hyper-V and importing a small VM, often disguised as "WSL." Running inside the VM helps evade host-based EDR/XDR visibility while Hyper-V Default Switch/NAT makes outbound traffic appear to originate from the victim host IP.

Its primary function is to provide a persistent reverse shell. CurlyShell runs as a headless background daemon, closes standard file descriptors to suppress output, connects to command-and-control over HTTPS, and executes operator commands via a shell with a 30-second timeout, returning captured stdout/stderr. The malware uses a custom Base64 alphabet, generates a random Base64-encoded value as a PHP session cookie for C2 traffic, and expects the server to echo that value back as part of handshake validation. Reporting also states it allows the threat actor to run encrypted commands.

Persistence is implemented inside the Alpine VM via root cron. A root crontab entry runs /bin/alpine_init at 20 minutes past every fourth hour, and that script launches the CurlyShell binary using nohup with output redirected to /dev/null. In one documented case, CurlyShell was stored at /bin/init_tools inside the VM, with MD5 c6dbf3de8fd1fc9914fae7a24aa3c43d. It has been described as enabling operational stealth and communication alongside the companion implant CurlCat, which can be launched on demand for SSH tunneling and reverse proxying.

The malware has been associated with post-compromise persistence and covert access in intrusions affecting government and judicial bodies in Georgia and an energy distribution company in Moldova, and more broadly with campaigns targeting Western critical infrastructure, especially the energy sector, as well as telecommunications and technology organizations across North America, Europe, and the Middle East. Related tradecraft observed with the same actor includes Kerberos ticket injection into LSASS, Group Policy-delivered PowerShell for local account creation or password resets, and use of additional tunneling tools such as Ligolo-ng, Stunnel, Resocks, and SSH-based methods.