Curly COMrades: Abnormal Hyper-V Activation

Abnormal Hyper-V Activation

The research uncovers a new threat actor, Curly COMrades, that leverages Windows Hyper‑V to spin up a hidden Alpine Linux VM on compromised Windows 10 hosts. The VM runs custom malware (CurlyShell and CurlCat) to provide persistent reverse‑shell and proxy capabilities while evading typical EDR detection. Additional techniques include PowerShell‑based Kerberos ticket injection, Group‑Policy‑delivered local account creation, and use of open‑source proxy tools.

What Curly COMrades uses to hide malware in Linux VMs?

Curly COMrades hide malware by creating tiny Alpine Linux guests inside Microsoft Hyper-V on compromised Windows hosts, running custom implants (reported as CurlyShell and CurlCat) inside those hidden VMs while using Hyper-V’s networking (Default Switch) so outbound traffic appears to come from the host.

They deploy PowerShell helpers and curl.exe on the host, give deceptive VM names and restrict Hyper-V management interfaces to avoid detection, and were documented in a Bitdefender analysis with technical indicators and remediation guidance.

Simulations

Executive Summary

Test Case ID: TC-20251105-AB12C
TTPs: T1558.005, T1546.013, T1037
Detection Rule Logic Summary: The rule fires when PowerShell command‑line logs contain either a hard‑coded Import‑VM path to a hidden Hyper‑V VM file or a Start‑VM invocation with the name WSL.
Detection Rule Language/Format: sigma (yaml)
Target Security Environment:

• OS: Windows 10/Server 2016+ (Hyper‑V enabled)
• Logging: PowerShell Script Block Logging (EventID 4104) + Microsoft‑Windows‑Hyper‑V‑Admin Operational logs
• Security Stack: SIEM/EDR capable of ingesting Windows Event Logs (e.g., Azure Sentinel, Splunk, Elastic)

Resilience Score (1-5): 2
Justification: The rule relies on…
View Full Simulations