Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

Reddit NetSec

AlienVault OTX General

CVE Database V5

Exploit-DB RSS Feed

Reddit InfoSec News

ThreatFox MISP Feed

CIRCL OSINT Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

Bitdefender Labs has uncovered a new threat actor group named Curly COMrades, operating since mid-2024 to support Russian interests. The group targets critical organizations in countries experiencing geopolitical shifts, focusing on judicial and government bodies in Georgia and an energy distribution company in Moldova. Their primary objective is to maintain long-term network access and steal credentials. The attackers use proxy tools like Resocks, SSH, and Stunnel to establish multiple entry points, and deploy a new backdoor called MucorAgent. They also utilize compromised legitimate websites as traffic relays to complicate detection. The group's tactics include credential theft, lateral movement, and data exfiltration, employing both custom and open-source tools.

The Curly COMrades threat actor group, identified by Bitdefender Labs in mid-2024, is a state-aligned cyber espionage entity supporting Russian geopolitical interests. Their operations focus on critical infrastructure and government institutions in regions undergoing geopolitical tension, specifically targeting judicial and governmental bodies in Georgia and an energy distribution company in Moldova. The group’s primary goal is to maintain persistent, long-term access to victim networks to conduct credential theft, lateral movement, and data exfiltration. They employ a sophisticated toolkit combining custom malware and open-source tools. A notable component is their proprietary backdoor named MucorAgent, which facilitates stealthy remote access. To evade detection and complicate attribution, Curly COMrades leverage proxy tools such as Resocks, SSH tunnels, and Stunnel, establishing multiple redundant entry points. Additionally, they exploit compromised legitimate websites as traffic relays, masking command and control communications within legitimate network traffic. Their tactics include credential dumping (T1003), lateral movement (T1021), process injection (T1055), and hijacking CLSID entries (T1212), among others, reflecting a mature and multi-faceted attack methodology. The absence of known exploits in the wild suggests targeted, selective operations rather than broad campaigns. Overall, Curly COMrades represent a persistent threat actor with capabilities tailored for espionage and network persistence in geopolitically sensitive environments.

Detailed information about A New Threat Actor Targeting Geopolitical Hotbeds. Get real-time updates, technical details, and mitigation strategies.

Title	Severity	Type	Source	Date

Threats Tagged 'clsid hijacking'

Filter Threats

Threats Tagged 'clsid hijacking'

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility