New Russian-Linked Cyber-Espionage Group "Curly COMrades" Targets Government and Energy Sectors A newly identified cyber-espionage threat group, tracked as Curly COMrades, has been conducting operations aligned with Russian geopolitical interests since mid-2024. The group has targeted government and judicial bodies in Georgia and energy firms in Moldova, deploying a sophisticated custom backdoor malware called MucorAgent. ### Attack Chain and Tactics Curly COMrades employs a three-stage .NET-based malware designed for stealth and persistence. The attack begins with an undetermined initial access vector, followed by the deployment of proxy agents like the Go-based Resocks, which is retrieved via curl.exe and registered as scheduled tasks or Windows services for persistence. Communication with the command-and-control (C2) server occurs over TCP ports 443 or 8443. For redundancy, the group uses custom SOCKS5 servers, SSH with Stunnel for remote port forwarding, and a tool called CurlCat, which obfuscates traffic by relaying it through compromised legitimate websites using libcurl and a custom Base64 alphabet. ### Unconventional Persistence Mechanisms Bitdefender researchers observed an unpredictable persistence method involving the hijacking of Component Object Model (COM) objects to target NGEN (Native Image Generator), a Windows .NET Framework component. The malware leverages a disabled scheduled task that executes at random intervals, such as during system idle times or application deployments. The group also deployed legitimate remote monitoring tools, including Remote Utilities (RuRat) and RMM software, to maintain interactive control over compromised systems. ### MucorAgent Backdoor Capabilities The MucorAgent backdoor consists of three components: 1. COM hijacking to load a second .NET stage. 2. AMSI bypass to evade Windows’ Antimalware Scan Interface. 3. Encrypted payload execution, where the malware searches for index.png and icon.png files actually encrypted data blobs downloaded from compromised websites. The threat actor conducted credential theft, including attempts to dump the NTDS database from domain controllers and extract LSASS memory for active credentials. They also used living-off-the-land (LOLBin) commands (e.g., netstat, tasklist, systeminfo, wmic, ipconfig) and PowerShell Active Directory enumeration to move laterally and exfiltrate data. ### Detection and Attribution Despite efforts to blend malicious activity with legitimate traffic, Curly COMrades’ operations generated enough detectable noise to be flagged by modern EDR/XDR solutions. While no direct links to known Russian APT groups have been confirmed, the targeting of Georgian and Moldovan entities aligns with Russian strategic interests. The group’s heavy reliance on curl.exe for exfiltration and COM hijacking led researchers to name them Curly COMrades.