they installed linux. thats the hack.

Quick Overview

The main hack demonstrated is that threat actors utilized the Hyper-V feature on compromised Windows machines to deploy a lightweight, hidden Alpine Linux virtual machine (VM) for evasion and persistence, a technique that bypasses traditional host-based Endpoint Detection and Response (EDR) solutions because the VM's memory is inaccessible to the host OS security tools.

Key Points: Attackers established covert, long-term access by deploying a lightweight Alpine Linux VM via the built-in Hyper-V feature on compromised Windows 10 machines. The hidden VM environment was minimal, using only 128MB disk space and 256MB memory, hosting custom malware including CurlyShell (reverse shell) and CurlCat (reverse proxy). This VM-based persistence technique successfully evaded Windows Defender because the host security tools could not inspect the memory or file system activity within the isolated Hyper-V guest OS. The attackers used PowerShell scripts to enable Hyper-V and subsequently disable the GUI interface, forcing the system to run the VM invisibly in the background. The technique is considered highly effective because, while Windows Defender can detect the initial malware used for deployment, it cannot scan the execution environment inside the Hyper-V VM. Persistence involved setting up a cron job to execute an Alpine Linux script every four hours, ensuring continued command and control access.

Context: The video analyzes a sophisticated threat campaign documented in a Bitdefender report titled "Curly COMRades: Evasion and Persistence via Hidden Hyper-V Virtual Machines," which details how threat actors, suspected to be Russian actors operating since August 2025, exploited native Windows virtualization features for stealthy operations. The analysis focuses on how leveraging Hyper-V allows malware to execute within an isolated operating system environment that is difficult for standard host-based security solutions like Windows Defender to monitor.

Detailed Analysis