Forensic investigations uncover malware running inside lightweight VMs on Windows hosts, revealing advanced evasion and persistence tactics since July 2025.

A complex cyber operation has been linked to a group abusing a virtualization feature in operating systems to hide long-term access within targeted networks.

Investigators found the attackers creating covert, self-contained environments on Windows hosts by enabling Hyper-V and running lightweight virtual machines (VMs) that housed custom malware for remote access and proxy tunneling.

The hidden VMs were based on a minimal Alpine Linux image consuming only 120MB of disk space and 256MB of memory. Within these, the attackers had deployed two custom programs serving different roles: a persistent reverse shell, and a reverse proxy — both built around the same C++ code base.

By isolating these payloads inside VMs, the intruders were able to conceal their operations from standard endpoint detection and response tools.

According to investigations by BitDefender analysts (conducted with support from the Georgian CERT), the campaign began in early July 2025 when:

• compromised systems were remotely instructed to enable Microsoft’s virtualization feature and disable its management interface.
• PowerShell commands were then imported and they launched pre-configured VMs under deceptive names resembling legitimate Windows features.
• Once activated, the malware’s communications blended with normal network traffic by routing through the host’s network stack, making outbound connections appear legitimate.

Forensic analysis has revealed additional components designed for persistence and lateral movement. Scripts abusing Kerberos tickets were used to execute remote commands, while Group Policy scripts repeatedly reset local account passwords on compromised machines to maintain access even after remediation.

The attackers had demonstrated significant operational discipline, encrypting key payloads, erasing command histories, and restricting logs on compromised hosts. It was only after a compromised site in Georgia was found relaying the attackers’ command-and-control traffic, that the operation was discovered by BitDefender and collaborations with international incident response teams.

Further analysis has confirmed redirection mechanisms that disguised SSH communications within standard HTTPS traffic. Forensics suggest the attackers have links to Russian-aligned threat actors, based on their technical tactics.

According to Bitdefender, which led the investigations of affected customer installations, the use of lightweight virtual machines marks a “notable evolution in attacker tradecraft.” As advanced detection tools become common, adversaries are increasingly turning to native virtualization system features for stealth and persistence, underscoring the need for multilayered network and host monitoring.