Curly COMrades: Abnormal Hyper-V Activation

Abnormal Hyper-V Activation

The research uncovers a new threat actor, Curly COMrades, that leverages Windows Hyper‑V to spin up a hidden Alpine Linux VM on compromised Windows 10 hosts. The VM runs custom malware (CurlyShell and CurlCat) to provide persistent reverse‑shell and proxy capabilities while evading typical EDR detection. Additional techniques include PowerShell‑based Kerberos ticket injection, Group‑Policy‑delivered local account creation, and use of open‑source proxy tools.

What Curly COMrades Uses to Hide Malware in Linux VMs?

Curly COMrades hide malware by creating tiny Alpine Linux guests inside Microsoft Hyper-V on compromised Windows hosts, running custom implants (reported as CurlyShell and CurlCat) inside those hidden VMs while using Hyper-V’s networking (Default Switch) so outbound traffic appears to come from the host.

They deploy PowerShell helpers and curl.exe on the host, give deceptive VM names and restrict Hyper-V management interfaces to avoid detection, and were documented in a Bitdefender analysis with technical indicators and remediation guidance.

Mitigation

Deploy host‑based network inspection (e.g., Bitdefender NAD) to detect anomalous outbound traffic from the host network stack. Harden Windows by disabling or tightly controlling Hyper‑V feature enablement and restricting use of DISM and PowerShell cmdlets that import/start VMs. Apply Proactive Hardening and Attack Surface Reduction (PHASR) to block unauthorized use of native binaries (curl, rar, Import‑VM, Start‑VM). Monitor for creation of new Hyper‑V VMs, unusual VHDX/VMCX files in ProgramData, and crontab modifications on Linux VMs. Detect LSASS access and Kerberos ticket injection using EDR/XDR credential‑access alerts. Enforce least‑privilege for Group‑Policy scripts and audit local account creation. Use signature‑based and behavioral detection for custom implants CurlyShell/CurlCat and known proxy tools.

Response

Isolate affected hosts, disable Hyper‑V, and remove the hidden VM files and associated VHDX/VMCX images. Conduct a full file‑system and registry scan for the PowerShell scripts (kb_upd.ps1, screensaver.ps1, locals.ps1) and delete them. Reset or remove any unauthorized local accounts and rotate passwords. Block outbound connections to the identified C2 IPs (e.g., 45.43.91.10, 88.198.91.116) and update firewall rules. Deploy detection rules for the specific DLL/ELF signatures of CurlyShell and CurlCat, and for the proxy tools observed. Conduct threat‑hunt using IOCs from the public GitHub repository. Engage with CERTs for intel sharing and monitor for further activity. Apply patches and update to mitigate any CVEs exploited (if any were identified).

Simulation Instructions

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre‑flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic. Abstract or unrelated examples will lead to misdiagnosis.

• Attack Narrative & Commands:
  The attacker has already compromised a low‑privileged user account and escalated to a service account that possesses Hyper‑V Administrator rights. To maintain stealthy persistence, they craft a hidden VM image stored in the AppV cache directory (c:\programdata\microsoft\AppV\app\Virtual Machines\1DBCC80B-5803-4AF1-8772-712C688F408A.vmcx). Using PowerShell, they import this VM silently and start it with the name WSL, masquerading as a legitimate Windows Subsystem for Linux instance. This exact command line matches the Sigma rule’s hard‑coded strings, ensuring the alert fires.

• Regression Test Script:

  # -------------------------------------------------
  # Simulation of Curly COMrades Hyper‑V persistence
  # -------------------------------------------------
  # Variables (mirroring the exact strings in the rule)
  $vmPath = 'c:\programdata\microsoft\AppV\app\Virtual Machines\1DBCC80B-5803-4AF1-8772-712C688F408A.vmcx'
  $vmName = 'WSL'