Inside Curly COMrades.

This week, we are joined by Martin Zugec, Technical Solutions Director from Bitdefender, sharing their work and findings on "Curly COMrades: A New Threat Actor Targeting Geopolitical Hotbeds." Bitdefender Labs has uncovered a newly identified Russian-aligned threat actor dubbed “Curly COMrades,” responsible for espionage campaigns against judicial, government, and energy organizations in Eastern Europe. The group focuses on long-term network access, credential theft, and stealthy persistence techniques — including a never-before-seen backdoor called MucorAgent that hijacks Windows CLSIDs and leverages NGEN for covert execution. By routing data through compromised websites and using tools like curl.exe and proxy relays, Curly COMrades blend malicious traffic with legitimate activity, complicating detection and signaling a highly organized, evolving operation. The research can be found here: Curly COMrades: A New Threat Actor Targeting Geopolitical Hotbeds