Curly COMrades cyberspies hit govt orgs with custom malware

A new cyber-espionage threat group has been using a new backdoor malware that provides persistent access through a seemingly inactive scheduled task. The threat actor's operations appear to support Russian interests by targeting government and judicial bodies in Georgia, and energy firms in Moldova. The attacker is currently tracked as Curly COMrades and has been active since mid-2024 and is using a custom three-stage mallware component that researchers call MucorAgent. In a report today, cybersecurity company Bitdefender describes MucorAgent as a "complex" piece of malware "engineered as a .NET stealthy tool capable of executing an AES-encrypted PowerShell script and uploading the resulting output to a designated server." The researchers named the threat actor Curly COMrades due to the heavy use of the curl.exe tool for data exfiltration and communicating with the command-and-control (C2) server, and because of hijacking Component Object Model (COM) objects during the attack. While no strong overlaps with known Russian APT groups have been found, the researchers say that the threat "group's operations align with the geopolitical goals of the Russian Federation." The researchers couldn't determine the initial access vector but observed the installation of multiple proxy agents, including the Go-based Resocks, across internal systems. Resocks is retrieved via curl.exe and registered as scheduled tasks or Windows services for persistence, communicating with the C2 via TCP 443 ...