+- Hack Forums (https://hackforums.net)
+-- Forum: General Topics (https://hackforums.net/forumdisplay.php?fid=7)
+--- Forum: World (https://hackforums.net/forumdisplay.php?fid=445)
+---- Forum: News and Happenings (https://hackforums.net/forumdisplay.php?fid=89)
+---- Thread: New Curly COMrades APT Using NGEN COM Hijacking in Georgia, Moldova Attacks (/showthread.php?tid=6306385)
New Curly COMrades APT Using NGEN COM Hijacking in Georgia, Moldova Attacks - Stanley - Aug 21, 2025
New ‘Curly COMrades’ APT Using NGEN COM Hijacking in Georgia, Moldova Attacks
A previously undocumented threat actor dubbed Curly COMrades has been observed targeting entities in Georgia and Moldova as part of a cyber espionage campaign designed to facilitate long-term access to target networks.
"They repeatedly tried to extract the NTDS database from domain controllers -- the primary repository for user password hashes and authentication data in a Windows network,"
https://thehackernews.com/2025/08/new-curly-comrades-apt-using-ngen-com.html
RE: New Curly COMrades APT Using NGEN COM Hijacking in Georgia, Moldova Attacks - JoseMar - Sep 2, 2025
(Aug 21, 2025 10:55 PM)Stanley Wrote: New ‘Curly COMrades’ APT Using NGEN COM Hijacking in Georgia, Moldova Attacks
A previously undocumented threat actor dubbed Curly COMrades has been observed targeting entities in Georgia and Moldova as part of a cyber espionage campaign designed to facilitate long-term access to target networks.
"They repeatedly tried to extract the NTDS database from domain controllers -- the primary repository for user password hashes and authentication data in a Windows network,"
https://thehackernews.com/2025/08/new-curly-comrades-apt-using-ngen-com.html
They're really getting creative with the names, "Curly COMrades." Honestly, the way they hijack COM objects is pretty clever, in a scary way. It’s like they’re hiding in plain sight inside the system.
RE: New Curly COMrades APT Using NGEN COM Hijacking in Georgia, Moldova Attacks - W1NK1LL3RX - Sep 2, 2025
(Aug 21, 2025 10:55 PM)Stanley Wrote: New ‘Curly COMrades’ APT Using NGEN COM Hijacking in Georgia, Moldova Attacks
A previously undocumented threat actor dubbed Curly COMrades has been observed targeting entities in Georgia and Moldova as part of a cyber espionage campaign designed to facilitate long-term access to target networks.
"They repeatedly tried to extract the NTDS database from domain controllers -- the primary repository for user password hashes and authentication data in a Windows network,"
https://thehackernews.com/2025/08/new-curly-comrades-apt-using-ngen-com.html
That’s wild. Sounds like a really advanced group if they’re going after domain controllers and password hashes. Definitely not the kind of attack you’d want slipping under the radar.
RE: New Curly COMrades APT Using NGEN COM Hijacking in Georgia, Moldova Attacks - sharn - Sep 14, 2025
Dumping NTDS and LSASS shows they want full access.
They are after credentials, not just files.
RE: New Curly COMrades APT Using NGEN COM Hijacking in Georgia, Moldova Attacks - plops - Sep 14, 2025
Wow they really are going after long term access of many cred.