Bitdefender first documented the Curly COMrades threat actor, operating to support Russian interests in geopolitical hotbeds, in August 2025. Since that initial discovery, subsequent forensics and incident response efforts have revealed critical new tools and techniques. Valuable support was provided by the Georgian CERT, whose collaboration significantly advanced the investigation. It alerted us to a detected sample communicating with a compromised site we were monitoring, enabling a joint analysis. The Georgian CERT was then instrumental in evidence acquisition and conducting a forensic analysis of the compromised site itself, which the attackers leveraged as a proxy to their actual ...