A new cyber-espionage threat group has been using a custom backdoor malware that provides persistent access through a seemingly inactive scheduled task. The threat actor's operations appear to support Russian interests by targeting government and judicial bodies in Georgia, and energy firms in Moldova. The attacker is currently tracked as Curly COMrades, has been active since mid-2024 and is using a custom three-stage malware component that researchers call MucorAgent. Curly COMrades attack chain In a report today, cybersecurity company Bitdefender describes MucorAgent as a "complex" piece of malware "engineered as a .NET stealthy tool capable of executing an AES-encrypted PowerShell script and uploading the resulting output to a designated server." The researchers named the threat actor…