New TASK#STOMP Backdoor Uses PowerShell to Steal Documents and Wi-Fi Passwords

TASK#STOMP is a newly analyzed Windows backdoor that turns ordinary built-in tools into a durable spying operation.

It uses a Visual Basic Script installer, hidden PowerShell, scheduled tasks, and runtime code compilation to collect business documents, saved Wi-Fi passwords, clipboard data, and screenshots from compromised machines.

The observed infection begins with a randomly named VBS file in a user-accessible location. Its delivery route remains unconfirmed: the available evidence cannot distinguish phishing, a browser download, removable media, remote access, or an extracted archive. Once launched, the script builds several ways to survive a restart or partial cleanup.

Securonix said in a report shared with Cyber Security News (CSN) that its analysts decoded the final payloads and identified TASK#STOMP as a fully working PowerShell backdoor.

The research shows the operation is built for continued collection and remote control, rather than an immediately destructive attack.

That combination raises the risk for organizations holding sensitive files. Attackers can search every fixed drive for recent documents and archives, then keep watching for new or changed files.

The backdoor also accepts commands from its operators, leaving an infected computer open to further theft, additional malware, or disruptive actions. It also gathers system and network details for registration.

New TASK#STOMP Backdoor Uses PowerShell

The main module searches fixed drives for Word, PDF, PowerPoint, Excel, and archive files. It favors documents created or changed during the past year, skips files larger than 500 MB, and uploads selected material to its command servers.

A file watcher then monitors drives so later changes can be taken too. It also runs Windows netsh commands to list stored wireless profiles and expose their saved keys in plain text.

Clipboard content is copied, sent out, and cleared, while screenshots of the main display can be captured on command. These functions make TASK#STOMP a broad data-collection tool, similar to the credential-harvesting behavior discussed in Wi-Fi credential theft campaigns.

Two separate PowerShell branches divide the workload. One decodes the document-stealing payload, while the other maintains a second command channel with overlapping capabilities.

They can restart each other, and their servers fail over if one connection fails, helping the operator keep access when a process or network route is interrupted. The malware hides its network traffic behind a Chrome-like user agent and compiles small C# helpers within PowerShell.

Those helpers accept invalid TLS certificates, which can let the backdoor reach its servers even when certificate checks would normally stop the connection. The activity resembles other cases where PowerShell scripts deliver backdoors through native Windows components.

Persistence and Response Priorities

TASK#STOMP establishes four scheduled tasks from XML files stored under a user-writable AppData folder, then drops msdiag.vbs in the Startup folder.

The tasks use rotating names that resemble Windows services, making a quick review less reliable. This technique closely reflects the abuse covered in Windows task persistence techniques, where trusted scheduling features are turned into a long-term foothold.

Before relaunching its modules, the script ends earlier instances, changes several file timestamps to January 15, 2024, and starts PowerShell with hidden-window and execution-policy-bypass settings.

Both PowerShell processes then launch the legitimate C# compiler, csc.exe. This full sequence is far more useful to defenders than one filename or task name alone.

Security teams should investigate VBS or Windows Script Host processes that create tasks from AppData, especially when they are followed by hidden PowerShell and compiler activity.

PowerShell Script Block Logging, AMSI records, Task Scheduler logs, and endpoint file events can preserve the commands and temporary files needed to reconstruct the chain.

Comparable hidden PowerShell persistence activity has also shown why native tool misuse needs behavioral detection. Containment must be coordinated.

Teams should preserve task XML and staged files, stop active VBS and PowerShell processes, remove every scheduled task and Startup entry, block the confirmed infrastructure, and reboot to confirm nothing returns. Removing only one script or task may allow the remaining components to rebuild the infection.

Indicators of compromise (IoCs):-

Type	Indicator	Description
C2 domain	corecloudfileshare[.]xyz	Primary TASK#STOMP command-and-control server
C2 domain	attachmentsharingdrive[.]xyz	Backup command-and-control server used for failover
URL	hxxps://www[.]irantenders[.]com/tender/tot-delete-6e137de.php	URL opened by Chrome during the observed execution chain
HTTP header	X-Auth-Token: rRRcoksYyhkueVRBv4V6yFDW2ZHRwdpKzJjI2wRo	Static authentication token used in C2 requests
File name	95c9050t66.vbs	Randomly named initial VBS installer
File name	msdiag.vbs	Startup-folder persistence script
File name	task.xml	Scheduled-task XML definition
File name	task2.xml	Scheduled-task XML definition
File name	task3.xml	Scheduled-task XML definition
File name	task4.xml	Scheduled-task XML definition
File name	sys_loader.ps1	PowerShell loader for the document-theft module
File name	diag_pack.dat	Base64-encoded document-theft and backdoor payload
File name	win_conn.ps1	PowerShell loader for the secondary C2 module
File name	win_conn_cfg.dat	Base64-encoded secondary C2 payload
File name	purge.bat	Cleanup batch file
SHA256	5251098838fab2f3192307cac99ad2d3a71b55ba1f256412d43a9	Hash listed for 95c9050t66.vbs and msdiag.vbs
SHA256	7a9e7b4c2f75f7de03838f5c9589148cdbefb76200ea3cf2d6f1a	Hash listed for task.xml
SHA256	ff12c194128d0733434ce1580691bfde5896f14ba9f360c0f6c3a6	Hash listed for task2.xml
SHA256	e46111264ebd91e80bbad85141d254930354faa0f15d3bbfaf4826	Hash listed for task3.xml
SHA256	335d19f4e757e0c36c9ef1cb4638e151aac041b7814e3eb8bda6f7	Hash listed for task4.xml
SHA256	103b4d4a666bc0a89c10c9df55f54f4be5fa111e8429c37ae14fa8	Hash listed for sys_loader.ps1
SHA256	02ba7c982b68ec8f5a1cb47c6f3969f3f2f38ea9b4ebb8833d1b8	Hash listed for diag_pack.dat
SHA256	8f448080cec5cba2f0ba6a960bc3425a2d99a6767464f581d134	Hash listed for win_conn.ps1
SHA256	41231e7f5db49055dbe4246462e60077a67b1845696df3947eb1	Hash listed for win_conn_cfg.dat
SHA256	bd200756b4e996a6e7cc63036aa760f9585f252c55a60cab12f2	Hash listed for purge.bat

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC