TASK#STOMP PowerShell Backdoor Steals Business Documents and Executes Remote Commands
TASK#STOMP Windows backdoor combines VBScript, PowerShell, scheduled tasks, and runtime C# compilation for resilient document theft and remote command execution.
Securonix documented TASK#STOMP, a Windows backdoor whose VBScript installer stages under %LOCALAPPDATA%\WinDefendSvc, registers four scheduled tasks, and drops a Startup-folder script that can restore removed components on sign-in. Two hidden PowerShell modules search fixed drives for business documents (Office files, PDFs, archives under 500 MB), capture screenshots, extract Wi-Fi passwords via netsh, harvest clipboard data, and execute arbitrary PowerShell via Invoke-Expression. Stolen data goes to dual token-authenticated C2 servers (corecloudfileshare[.]xyz and attachmentsharingdrive[.]xyz), and an Add-Type-compiled C# helper disables TLS certificate validation. The initial access vector is unconfirmed.