Cybercriminals Hide in Cloud, Weaponize Hyper-V for Stealth Attacks

Cloud security took center stage this week as fresh revelations surfaced about threat actors using Windows Hyper-V virtualization to run lightweight Linux virtual machines hidden inside victim networks. These tactics, attributed to a Russia-aligned group called Curly COMrades, enabled attackers to evade detection by most endpoint security and EDR systems, embedding their “CurlyShell” reverse shell and proxy tools well out of conventional reach.

The incident illuminates the ingenuity of modern attackers, who increasingly blend cloud technology and virtualization to cover their tracks. Security analysts urge organizations to monitor cloud and virtual infrastructure as closely as physical assets, tighten access controls, and ensure network segmentation to limit attacker lateral movement.

The broader message is clear: as digital transformation accelerates, attackers are making themselves invisible within organizations’ own infrastructure. Defenders need advanced visibility tools and cloud-native threat hunting playbooks to keep up with this ever-adapting “hide-and-seek” game in cyberspace.

08-11-2025