# they installed linux. thats the hack.

Source: https://www.youtube.com/watch?v=2_PS4opc5zo
Recap page: https://rapidrecap.app/video/2_PS4opc5zo
Generated: 2025-11-17T19:01:16.824+00:00

---
## Quick Overview

The main hack demonstrated is that threat actors utilized the Hyper-V feature on compromised Windows machines to deploy a lightweight, hidden Alpine Linux virtual machine (VM) for evasion and persistence, a technique that bypasses traditional host-based Endpoint Detection and Response (EDR) solutions because the VM's memory is inaccessible to the host OS security tools.

**Key Points:**
- Attackers established covert, long-term access by deploying a lightweight Alpine Linux VM via the built-in Hyper-V feature on compromised Windows 10 machines.
- The hidden VM environment was minimal, using only 128MB disk space and 256MB memory, hosting custom malware including CurlyShell (reverse shell) and CurlCat (reverse proxy).
- This VM-based persistence technique successfully evaded Windows Defender because the host security tools could not inspect the memory or file system activity within the isolated Hyper-V guest OS.
- The attackers used PowerShell scripts to enable Hyper-V and subsequently disable the GUI interface, forcing the system to run the VM invisibly in the background.
- The technique is considered highly effective because, while Windows Defender can detect the initial malware used for deployment, it cannot scan the execution environment inside the Hyper-V VM.
- Persistence involved setting up a cron job to execute an Alpine Linux script every four hours, ensuring continued command and control access.

![Screenshot at 00:05: A screenshot of the Bitdefender article detailing the threat actors' evasion and persistence via hidden Hyper-V virtual machines, which is the core subject of the entire video analysis.](https://ss.rapidrecap.app/screens/2_PS4opc5zo/00-00-05.png)

**Context:** The video analyzes a sophisticated threat campaign documented in a Bitdefender report titled "Curly COMRades: Evasion and Persistence via Hidden Hyper-V Virtual Machines," which details how threat actors, suspected to be Russian actors operating since August 2025, exploited native Windows virtualization features for stealthy operations. The analysis focuses on how leveraging Hyper-V allows malware to execute within an isolated operating system environment that is difficult for standard host-based security solutions like Windows Defender to monitor.

## Detailed Analysis

The video explains the evasion technique employed by the Curly COMRades threat actor, which centers on abusing the native Microsoft Hyper-V feature on compromised Windows systems to host a persistent, low-visibility malware implant. The attackers installed an entire operating system—a lightweight Alpine Linux-based VM—running invisibly on the host machine. This VM, which used minimal resources (128MB disk, 256MB RAM), hosted custom malware like CurlyShell and CurlCat, allowing command execution and C2 communication that bypassed traditional host-based EDR solutions like Windows Defender because they lack access to the VM's isolated memory space. The initial deployment involved PowerShell commands to enable the Hyper-V feature while simultaneously disabling the graphical management interface. Persistence was established via a cron job within the Alpine VM that re-executed the implant script every four hours. The speaker emphasizes that this technique is effective because the execution environment is completely isolated from the host OS security tools, making detection extremely difficult unless security analysts are actively looking for Hyper-V-related artifacts or unusual system configurations.

### Threat Actor Technique

- Curly COMRades established covert, long-term access by abusing Hyper-V
- deployed a lightweight Alpine Linux VM
- used custom malware (CurlyShell, CurlCat) for persistence.

### Virtual Machine Configuration

- The VM was minimalist (128MB disk, 256MB memory) and used the host's Hyper-V feature, requiring enabling via command line while disabling the GUI.

### Evasion Mechanism

- The malware ran inside the isolated VM, making memory and file system activity invisible to host-based security tools like Windows Defender, which cannot inspect the guest OS memory.

### Persistence Details

- Persistence was achieved via a cron job in the Alpine VM executing a script every four hours, ensuring the implant remained active.

### Demonstration of Evasion

- The presenter shows that after extracting the malware zip inside the Linux subsystem, running antivirus scans on the host (Windows Security) does not detect the files, confirming the evasion from host security.

### Hyper-V vs. WSL

- The speaker notes that while WSL is visible via standard commands, Hyper-V VMs are difficult to detect without specific host-level inspection, as they operate at a lower level.

![Screenshot at 00:05: The presenter introducing the Bitdefender article covering evasion via hidden Hyper-V virtual machines.](https://ss.rapidrecap.app/screens/2_PS4opc5zo/00-00-05.png)
![Screenshot at 00:10: Highlighting the key phrase in the article: "Hidden Hyper-V Virtual Machines" used for evasion.](https://ss.rapidrecap.app/screens/2_PS4opc5zo/00-00-10.png)
![Screenshot at 01:31: Diagram illustrating the architecture where the Alpine Linux VM runs on top of the Hyper-V hypervisor, isolated from the Windows host OS.](https://ss.rapidrecap.app/screens/2_PS4opc5zo/00-01-31.png)
![Screenshot at 02:03: A diagram showing the standard architecture of Virtual Machines, with the Hypervisor layer separating Guest OSs from the Host OS and hardware.](https://ss.rapidrecap.app/screens/2_PS4opc5zo/00-02-03.png)
![Screenshot at 02:58: The presenter demonstrating the installation of Hyper-V using PowerShell commands on the Windows host.](https://ss.rapidrecap.app/screens/2_PS4opc5zo/00-02-58.png)
![Screenshot at 05:15: The presenter showing that Windows Defender fails to detect the extracted malware files when they reside within the Linux subsystem environment.](https://ss.rapidrecap.app/screens/2_PS4opc5zo/00-05-15.png)
![Screenshot at 06:57: The Windows Security interface confirming that the extracted malicious zip file \(Bash/Linux/Nix.Zip\) was detected on the host machine, contrasting with the VM's isolation.](https://ss.rapidrecap.app/screens/2_PS4opc5zo/00-06-57.png)
![Screenshot at 07:23: The presenter running Linux commands \(ls, id\) inside the WSL environment, showing user context within the isolated subsystem.](https://ss.rapidrecap.app/screens/2_PS4opc5zo/00-07-23.png)