Curly Comrades Unleash Sneaky Hyper-V Hack: EDRs Left in the Dust!
Alleged Russia-linked Curly COMrades exploit Windows Hyper-V to hide Linux VMs and evade EDR tools, deploying custom malware undetected. Researchers uncovered advanced virtualization misuse, revealing a stealthy operation that bypasses traditional security measures. This cyber caper proves even hackers love a good virtual disguise!
Hot Take:
Looks like the Curly Comrades have been taking some serious tips from the Russian school of “How to be a Ninja in Cyberspace.” Who knew Hyper-V could be the newest hide-and-seek champion? These guys turned Windows into their own little playground, and it seems they’ve got more tricks up their virtual sleeves than a magician at a kid’s birthday party!
Key Points:
- Curly Comrades have been exploiting Windows Hyper-V to hide Linux VMs and evade detection.
- They use custom malware, CurlyShell and CurlCat, within these hidden VMs.
- The group has been active since at least late 2023, employing layered intrusion strategies.
- Techniques include misuse of PowerShell scripts and Kerberos ticket exploitation.
- Security experts recommend multilayered security approaches to counter such advanced attacks.
Already a member? Log in here