New ‘Curly’ threat actor found targeting sensitive organizations in Georgia, Moldova

Researchers attribute an ongoing espionage campaign to a suspected Russia-aligned group dubbed “Curly COMrades,” active since late 2024 and targeting government, judicial, and energy organizations in Georgia and Moldova. The actors aim to maintain long-term access and harvest credentials using a mix of publicly available tools and custom malware (MucorAgent), hijacked Windows scheduled tasks, and compromised legitimate websites as C2/exfiltration relays to blend malicious traffic and evade detection.