Russian hackers hit Windows machines via Linux VMs with new custom malware

Ransomware .

• Curly COMrades deployed Alpine Linux VMs on Windows hosts to hide reverse-shell malware activity
• VM traffic tunneled via host IP, bypassing traditional EDR and masking outbound communications
• Targets included Georgian and Moldovan institutions; operations align with Russian geopolitical interests

Russian hackers known as Curly COMrades have been seen hiding their malware in Linux-based virtual machines (VM) deployed on Windows devices, experts have warned.