Full Report
Cybersecurity researchers have disclosed details of a new campaign dubbed TASK#STOMP that delivers a PowerShell backdoor designed to harvest sensitive data from compromised hosts. The backdoor "automatically harvests and exfiltrates business documents, watches the filesystem for new files in real time, steals Wi-Fi passwords and clipboard contents, takes screenshots, and accepts arbitrary
Analysis Summary
# Tool/Technique: TASK#STOMP
## Overview
TASK#STOMP is a sophisticated malware campaign and PowerShell-based backdoor framework designed for long-term persistence and sensitive data exfiltration. It primarily targets business documents, system credentials, and real-time user activity. The malware is notable for its "living-off-the-land" approach, utilizing native Windows components like VBScript, PowerShell, and Scheduled Tasks to evade detection, and features a redundant architecture to ensure operational resilience.
## Technical Details
- **Type:** Malware family / PowerShell Backdoor
- **Platform:** Windows
- **Capabilities:** Document harvesting, credential theft (Wi-Fi/Clipboard), screen capture, filesystem monitoring, and remote command execution.
- **First Seen:** September 2026 (Reported)
## MITRE ATT&CK Mapping
- **[TA0001 - Initial Access]**
- [T1566 - Phishing] (Suspected)
- **[TA0003 - Persistence]**
- [T1053.005 - Scheduled Task/Job: Scheduled Task]
- [T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder]
- **[TA0005 - Defense Evasion]**
- [T1027 - Obfuscated Files or Information]
- [T1070.006 - Indicator Removal: Timestomping]
- [T1140 - Deobfuscate/Decode Files or Information]
- [T1218.010 - System Binary Proxy Execution: Regsvr32] (VBScript via wscript)
- **[TA0009 - Collection]**
- [T1113 - Screen Capture]
- [T1115 - Clipboard Capture]
- [T1005 - Data from Local System]
- **[TA0011 - Command and Control]**
- [T1071.001 - Application Layer Protocol: Web Protocols]
## Functionality
### Core Capabilities
- **Information Stealing:** Automatically harvests business documents and exfiltrates system metadata.
- **Credential & Data Theft:** Steals saved Wi-Fi passwords and monitors/captures clipboard contents.
- **Surveillance:** Takes screenshots of the victim's desktop and watches the filesystem for newly created or modified files in real time.
- **Remote Access:** Accepts and executes arbitrary PowerShell commands through C2 channels.
### Advanced Features
- **Redundant Persistence:** Employs multiple scheduled tasks with deceptive names (e.g., "Local Credential Manager") and a backup VBScript in the Windows Startup folder.
- **Mutual Watchdog Mechanism:** Two separate PowerShell modules (`sys_loader.ps1` and `win_conn.ps1`) monitor each other; if one process is terminated, the other restarts it.
- **Anti-Forensics:** Utilizes "timestomping" (modifying file timestamps) and a cleanup batch script (`purge.bat`) to hinder forensic investigations.
- **Dual C2 Channels:** Uses two redundant, token-authenticated C2 servers for command execution and data exfiltration.
## Indicators of Compromise
- **File Names:**
- `95c9050t66.vbs` (Initial orchestrator)
- `msdiag.vbs` (Startup persistence)
- `sys_loader.ps1`, `win_conn.ps1` (Main modules)
- `diag_pack.dat`, `win_conn_cfg.dat` (Encoded payloads)
- `purge.bat` (Cleanup script)
- **Network Indicators:**
- `corecloudfileshare[.]xyz`
- `attachmentsharingdrive[.]xyz`
- `irantenders[.]com` (Decoy/Final stage URL)
- **Behavioral Indicators:**
- `wscript.exe` executing encoded VBScripts from the Desktop.
- Unexpected creation of scheduled tasks named "Local Credential Manager" or "Network Audio Service".
- PowerShell processes running with hidden windows for extended periods.
## Associated Threat Actors
- **Unknown:** While the malware redirects users to an Iranian government tender website, specific attribution has not been publicly confirmed.
## Detection Methods
- **Behavioral Detection:** Monitor for `wscript.exe` or `cscript.exe` spawning PowerShell with encoded or hidden flags. Monitor for the creation of scheduled tasks that mimic system service names.
- **File Monitoring:** Watch for the creation of `.dat` and `.vbs` files in user-writable directories like the Desktop or Startup folders.
- **Network Monitoring:** Alert on traffic to the identified malicious domains, particularly those involving unusual data upload volumes (exfiltration).
## Mitigation Strategies
- **Prevention:** Restrict or disable Windows Script Host (`wscript.exe`) and PowerShell for non-administrative users where not required.
- **Hardening:** Implement "Constrained Language Mode" for PowerShell to limit the execution of advanced commands used by the backdoor.
- **Audit:** Regularly audit Scheduled Tasks and the Windows Startup folder for unauthorized entries.
## Related Tools/Techniques
- **Living-off-the-Land (LotL):** Heavy reliance on native Windows binaries (Binary Proxy Execution).
- **Stealer Malware:** Shares characteristics with common info-stealers but adds robust C2 and persistence.