Curly COMrades: New Russian-Aligned Threat Actor Targeting Geopolitical Hotbeds

Unveiling Curly COMrades

• 💡 A newly identified Russian-aligned threat actor, dubbed "Curly COMrades," has been uncovered by Bitdefender Labs.
• 🎯 This group is responsible for espionage campaigns targeting judicial, government, and energy organizations in Eastern Europe, specifically in regions geopolitically situated between Russia and Europe.
• 🗓️ The group's activity was initially tracked from mid-2024, with evidence suggesting operations dating back to November 2023.

Tactics, Techniques, and Procedures (TTPs)

• 🔑 Curly COMrades focuses on achieving long-term network access, credential theft, and maintaining stealthy persistence.
• ⚙️ A novel backdoor, MucorAgent, has been documented, which hijacks Windows CLSIDs and uses NGEN for covert execution.
• 🌐 The threat actor leverages a large network of legitimate but compromised websites as traffic relays, blending malicious activity with normal web traffic to evade detection.
• 🔌 They employ various methods for maintaining access, including SSH tunnels and custom SOCKS5 servers, demonstrating a persistent effort to regain access if discovered.

MucorAgent and Persistence Techniques

• 🧠 The MucorAgent is a .NET-based tool that executes PowerShell and utilizes a unique activation method.
• 🛠️ It hijacks COM objects by modifying their target to execute the malicious agent instead of legitimate .NET framework components.
• ⏳ Activation relies on a disabled scheduled task that is triggered by the system's idle state during .NET pre-compilation (NGEN), making its execution unpredictable and difficult to detect.
• 🕵️ This technique, combined with hijacking hidden COM classes, makes the agent's execution and persistence highly sophisticated and novel.

Operational Sophistication and Resilience

• 📈 The group's use of compromised legitimate websites for command and control (C2) and traffic relay indicates a highly organized and advanced operation.
• 🔄 Curly COMrades demonstrates resilience by using multiple methods to re-establish access, including common binaries like SSH and tools like S tunnel to obfuscate traffic.
• 🎭 They are increasingly adopting a