New Hacker Group Found Hiding in Legitimate Websites

“Curly COMrades,” a hacker group with advanced espionage tactics, is targeting governments and energy companies in Eastern Europe.

Bitdefender Labs has identified a new hacker group, “Curly COMrades,” believed to be operating in support of Russian interests and targeting nations undergoing political change. Since mid-2024, the group has attacked judicial and government bodies in Georgia and an energy company in Moldova.

The hackers’ main goal is to “maintain long-term access to target networks and steal valid credentials.” They repeatedly tried to extract the NTDS database, which stores Windows user passwords, and dump LSASS memory to recover login details, possibly in plain text.

The “Curly COMrades” operation depends on establishing robust access points through Resocks, SSH, and Stunnel tools. The attackers use MucorAgent as their custom backdoor, which hides their access by hijacking Windows .NET Native Image Generator CLSIDs. The unpredictable nature of this persistence method makes it difficult to detect.

The attackers hide their operations by sending stolen data and remote commands through compromised legitimate websites, mixing malicious traffic with typical network activity. Bitdefender says “it’s very likely that what we’ve observed is just a small part of a much larger network of compromised web infrastructure they control.”

The lack of sufficient evidence led Bitdefender to avoid linking the group to any known hacking organizations. The researchers created a new name based on technical indicators, including ‘curl.exe’ usage and ‘COM object’ hijacking, to avoid glamorizing cybercrime activities.

The investigation started after proxy software activity raised suspicions which led to the discovery of a larger espionage operation. The researchers consider this group to be a major threat to high-value political and infrastructure targets given its tactics and persistence.