UKC-1230

UKC-1230 is a threat activity cluster associated with stealthy, long-term persistence on Windows systems through abuse of legacy scheduled tasks and COM handler execution. The actor modifies scheduled tasks, particularly tasks following the User_Feed_Synchronization-{GUID} naming pattern, to invoke attacker-registered COM objects instead of their normal behavior. This causes the COM Surrogate process to load malicious surrogate DLLs, providing covert code execution and sustained command-and-control persistence. The cluster is characterized by custom DLL-based persistence in which attacker-controlled COM class registrations point scheduled-task COM handlers to surrogate DLLs stored under Windows-related directories, typically using GUID-formatted filenames. Across observed samples, individual DLL hashes varied, indicating per-host or per-deployment customization, while shared structural characteristics suggested common tooling. The activity has demonstrated operational longevity, with observed compromises persisting for many months and broader artifacts indicating the technique has been in use since at least early 2024. High-confidence behaviors attributed to UKC-1230 include persistence through scheduled task modification, defense evasion through masquerading as legitimate Windows tasking and COM infrastructure, and post-compromise command-and-control beaconing. The initial access vector has not been established from available evidence. No reliable attribution to a nation state, criminal syndicate, or specific geographic origin is currently available. No confirmed aliases or sub-groups beyond the UKC-1230 tracking name are established from the available facts.