TASK#STOMP backdoor hides in Windows tools to steal data

A newly documented PowerShell backdoor called TASK#STOMP quietly takes business documents, saved Wi-Fi passwords, clipboard contents and screenshots from Windows computers, according to research published by the security firm Securonix. In a report shared with The Hacker News, Securonix researchers Akshay Gaikwad and Aaron Beardslee described a campaign that leans almost entirely on software already built into Windows, which is what makes its activity so hard to separate from normal system behaviour.

PowerShell is a scripting tool that ships with Windows and lets administrators automate jobs; attackers abuse it because it is already installed and already trusted. A backdoor is a hidden way into a machine that lets an outside operator send commands and pull data out. Securonix says TASK#STOMP does both. It automatically collects and sends out business documents, watches the file system in real time for newly created files, steals Wi-Fi passwords and whatever is sitting on the clipboard (the temporary store used when you copy and paste), captures screenshots, and accepts arbitrary remote commands through two redundant, token-authenticated command and control servers. Command and control (C2) servers are the remote machines an attacker uses to issue instructions and receive stolen data, and token-authenticated means the malware proves it is allowed to talk to them.

The researchers trace the start of the chain to a file on the victim's desktop named "95c9050t66.vbs", run through wscript.exe, the legitimate Windows component that executes VBScript files (a simple scripting language Windows can run). The exact pathway that delivered the file to the machine is unclear, although Securonix notes it may have been email-based phishing or social engineering, meaning a message that tricks the recipient into opening or running something. The random-looking file name is suspected to be an attempt to slip past security tools that block files by name. That VBScript then acts as the orchestrator, the part that establishes persistence (a way to survive reboots and keep running) and launches the stages that follow.

To stay on the host, the VBScript creates scheduled tasks, which are Windows jobs that start automatically at set times or in response to set events. They are given names such as Local Credential Manager, Network Audio Service, Windows Display Manager and Device Credential Handler, all chosen to resemble ordinary operating system components rather than anything suspicious. A second persistence method uses the Windows Startup folder, which launches programs each time a user logs in, to run another script payload called "msdiag.vbs". The malware also executes PowerShell commands that forcibly terminate previously running copies of itself so that only one active session remains. Securonix notes deliberate timestamp modification, also known as timestomping (altering a file's recorded dates to disguise when it was created or changed), hidden execution and cleanup behaviour, and says the combination suggests a deliberate effort to get around superficial administrative reviews and to complicate forensic analysis, the work of reconstructing what happened on a machine. Using more than one persistence method means the code keeps running even if one of them fails or is detected and removed.

In the next phase the chain runs two hidden PowerShell commands. The first, sys_loader.ps1, decodes a file called "diag_pack.dat" and initiates the document-stealing, surveillance and remote-access payload. The second, win_conn.ps1, decodes "win_conn_cfg.dat" and sets up a secondary, persistent C2 channel with command execution and collection capabilities. Securonix explains that running the modules as separate processes provides functional separation and operational redundancy, so that the failure or termination of one branch does not immediately remove the other. Both modules communicate with the same C2 infrastructure, the domains "corecloudfileshare[.]xyz" and "attachmentsharingdrive[.]xyz". The two components also keep an eye on each other: the researchers describe a mutual-watchdog relationship in which "diag_pack.dat" checks whether "win_conn.ps1" is running and restarts it if it is not, and the reverse is also true. The stated end goal of the attack is to provide a pathway for continuous document collection, credential and clipboard theft, screenshot capture, redundant C2 communications and arbitrary code execution, while using a range of techniques to stay under the radar.

In the final stage, the VBScript opens Google Chrome in a maximized window and loads a specific URL from "irantenders[.]com", a site that hosts a searchable database of tenders and contracts issued by government departments and local authorities in Iran. Securonix says the purpose of this user-facing web action is unknown. The same stage launches a batch script called "purge.bat" that invokes a two-second delay and likely carries out a cleanup to erase traces of the malicious activity, although the researchers note that what the script does is unknown because its contents have not been recovered.

The researchers place TASK#STOMP in a familiar pattern. "Threat actors routinely abuse Windows Script Host, PowerShell, Task Scheduler, and the .NET toolchain to blend malicious execution with legitimate administrative activity," they said. They describe the operation as a VBS-controlled framework that installs multiple persistence anchors and delegates follow-on functionality to PowerShell and dynamically compiled C# code (C# is a programming language, and compiling it means turning human-readable code into a program the computer can run). By relying almost entirely on native Windows components, they said, the operation reduces its dependence on conventional executable payloads and makes individual events harder to distinguish from benign system activity. The report does not name victims, and it does not say how many machines, if any, have been affected.

For website owners, businesses and IT teams, the practical point is that a machine can be compromised without any strange new program appearing in the usual places. Every stage of this chain uses software that already exists on Windows, and the scheduled tasks are named to look like ordinary system services. That makes checking what starts automatically at least as important as scanning for suspicious files, and it makes the records Windows keeps about what ran and when the place where this kind of activity has to be found. The single-session rule the malware enforces, killing its own older copies, is also a reminder that an attacker's own tidiness is what helps forensic work: fewer overlapping processes means clearer traces once someone looks.

For organisations that would rather have specialists review this side of their own environment, AEU-I is our security-first IT, infrastructure and consulting service, and its pages set out the work it does; that is simply a relevanc