Do Son Sandworm (APT44) has shifted tactics, favoring misconfigured edge devices over complex exploits to breach energy and telecom sectors via credential replay.
Curly COMrades
Bitdefender exposed Curly COMrades (Russian APT) using Hyper-V to run a hidden Alpine Linux VM. The VM hosts the CurlyShell backdoor, effectively bypassing host-based EDR for espionage.
Bitdefender Labs uncovers "Curly COMrades," a Russian-aligned cyber-espionage group using a new backdoor, MucorAgent, to target government and energy sectors.