The Russian hacker group Curly COMrades is abusing Microsoft Hyper-V in Windows to bypass endpoint detection and response solutions by creating a hidden Alpine Linux-based virtual machine to run malware. Inside the virtual environment, the threat actor hosted its custom tools, the CurlyShell reverse shell and the CurlCat reverse proxy, which enabled operational stealth and communication. Curly COMrades is a cyber-espionage threat group believed to be active since mid-2024. Its activities are closely aligned with Russian geopolitical interests. Bitdefender previously exposed Curly COMrades activities against government and judicial bodies in Georgia, as well as energy firms in Moldova. With the help of the Georgian CERT, the Romanian cybersecurity firm uncovered more about the threat…