Loading story…
Security researchers have identified new and stealthy techniques leveraging Microsoft’s Component Object Model (COM) and Distributed COM (DCOM) technologies for lateral movement and persistence within Windows environments. One report details the discovery of a previously undocumented DCOM object that can be abused for remote command execution and persistence by exploiting Control Panel items, highlighting both the technical mechanisms and detection strategies for defenders. The research also reviews the current state of tools like Impacket’s dcomexec script and discusses how adversaries enumerate and leverage COM objects for malicious purposes.
In a separate breach assessment, investigators uncovered a threat actor using a ComHandler within Windows Scheduled Tasks to maintain long-term command-and-control access. The attacker deployed custom surrogate DLLs and targeted tasks named User_Feed_Synchronization-{GUID} to execute code, remaining undetected for at least seven months. This technique, tracked as UKC-1230, demonstrates the real-world application of COM-based persistence and the challenges defenders face in detecting such abuse, especially when attackers mimic legitimate system activity.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
Securelist published research on abuse of the previously undocumented COpenControlPanel DCOM object for remote command execution and persistence. The report explained how attackers with administrative privileges could register arbitrary DLLs as Control Panel items, have them loaded by dllhost.exe, and use the method for lateral movement and persistence.
On publication, BHIS disclosed technical details of the UKC-1230 technique, including its use of COM Surrogate, scheduled task abuse, an imphash shared across samples, and attempted beaconing to techdataservice[.]us infrastructure. The report also provided hunting guidance and YARA/Sigma-style detections for defenders.
During a breach assessment, BHIS observed a stealthy Windows persistence and command-and-control technique that had remained active in a victim environment for at least seven months. The actor modified User_Feed_Synchronization scheduled tasks and used COM registration to load GUID-named malicious DLLs from disk.
Black Hills Information Security reported artifacts indicating the UKC-1230 persistence technique was in use in the wild as early as 2024-01-31. The activity involved hijacking legacy Windows scheduled tasks to invoke attacker-registered COM objects and load malicious DLLs through dllhost.exe.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
securelist.com
Open sourceblackhillsinfosec.com
Open sourcesynacktiv.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Trellix disclosed **PathWiper**, a destructive malware operation that abuses **DCOM** to move across Windows environments and trigger large-scale disk wiping. The activity was presented as a network erasure campaign rather than conventional ransomware, with the malware designed to render systems inoperable by corrupting or destroying data across affected hosts. The report highlights the use of legitimate Windows remote management mechanisms to propagate the wiper, underscoring how trusted administrative features can be turned into destructive tradecraft. For defenders, the findings point to the need for tighter controls on **DCOM** usage, stronger monitoring of lateral movement through native Windows components, and rapid containment of suspicious remote execution activity before wiping actions spread across the network.
Jul 10, 2026
Multiple reports describe ways attackers or testers can **abuse trusted enterprise features** to evade controls. Researchers reported that *Palo Alto Networks Cortex XDR* **Live Terminal** can be repurposed as a stealthy **command-and-control (C2)** channel because its WebSocket-based protocol lacks command signing; an attacker who can intercept the initial WebSocket message can redirect an endpoint to an attacker-controlled server/tenant, leveraging the trusted `cortex-xdr-payload.exe` component to execute commands in a “living off the land” manner. Separately, a tutorial showed *Microsoft Defender for Cloud Apps* (reverse-proxy `*.mcas.ms`) download restrictions for unmanaged devices can be **bypassed by spoofing specific browser user-agent strings**, allowing direct access to services like Outlook/SharePoint and enabling successful downloads that would otherwise be blocked. Other material in the set covers adjacent but distinct execution and delivery risks rather than the same product-specific bypasses. **CVE-2026-27615** affects *ADB-Explorer* on Windows: allowing `ManualAdbPath` to be set to a **UNC path** in a settings file can lead to **remote code execution** by pointing the app to an attacker-controlled network share, fixed in Beta `0.9.26022`. Cofense also documented ongoing campaigns abusing **Windows File Explorer WebDAV** handling to deliver malware without a browser download flow, including use of `trycloudflare[.]com` tunnels to host WebDAV servers and multi-stage script chains to deliver RATs—highlighting a persistent social-engineering and delivery vector that can bypass some browser-centric controls.
Jun 29, 2026
Russian-aligned threat actor Curly COMrades (also tracked as KTA487) has adopted advanced techniques to evade endpoint detection and response (EDR) solutions by leveraging Microsoft Hyper-V virtualization. Attackers deploy hidden Alpine Linux virtual machines within compromised Windows hosts, running custom reverse shells and proxies that operate outside the visibility of traditional security tools. This approach allows malicious traffic to be NAT-translated through the legitimate host IP, achieving a high degree of stealth and persistence, and represents a significant evolution in threat actor tradecraft targeting enterprise environments. Security researchers, including Bitdefender and Kroll, have documented these tactics as part of a broader trend in which sophisticated actors exploit legitimate system features to bypass commodity security controls. The use of architectural isolation, rather than direct engagement with EDR, signals a shift in adversary strategy and highlights the need for defenders to monitor for virtualization abuse and anomalous Hyper-V activity on endpoints. The campaign was first observed in July 2025 and publicly disclosed in November 2025, underscoring the ongoing risk to organizations relying solely on traditional endpoint security measures.
Jul 10, 2026