Hackers from the threat group known as Curly COMrades have turned the tables on traditional endpoint defence by weaponising Hyper‑V on compromised Windows systems. According to a recent report, the attackers enabled the Hyper-V role on target machines and spun up a lightweight Linux VM (just ~120 MB disk + 256 MB RAM) to host their custom tools—including a reverse shell “CurlyShell” and a proxy called “CurlCat”.
By hiding inside the VM, the attackers bypassed many host-based EDR and AV solutions that don’t inspect nested virtual environments.
The campaign, active since late 2023 and first documented in August 2025, specifically targeted regions like Georgia and Moldova, while using additional tools such as credential stealers and persistent implants.
For defenders, this shift underscores a key lesson: virtualization features like Hyper-V can be abused for stealthy operations, so monitoring for unusual VM creation and role-enabling on endpoints becomes crucial.
<a href="https://thehackernews.com/2025/11/hackers-weaponize-windows-hyper-v-to.html" target="_blank" rel="noopener nofollow">Read more</a>

This is a space to share content covering cybersecurity news, tools, source code, training courses, home lab setups, and basically anything that could be of interest to those who want to learn about cybersecurity. 

Cyber Security

The Curly COMrades threat group exploited Hyper-V virtualization on compromised Windows systems to evade endpoint detection. Attackers enabled Hyper-V, deployed a minimal Linux VM (120 MB disk, 256 MB RAM), and ran custom tools including CurlyShell reverse shell and CurlCat proxy inside the VM. This technique bypassed host-based EDR and AV solutions that don't inspect nested virtual environments. Active since late 2023 and documented in August 2025, the campaign targeted Georgia and Moldova. Defenders should monitor for unusual VM creation and Hyper-V role enablement on endpoints.

A New Era of VM-Powered Cyber Attacks

This is an interesting post. It wasn’t clear how the attacker managed to start Hyper-V. However, users who can create virtual machines without a password or prompt using commands like docker are potentially dangerous.

As usual, hackers are always being creative in exploiting new or existing ways to break into a system.

I can’t even create a hyper v VM manually. It’s crazy that they made malware that can do that.