TASK#STOMP PowerShell Backdoor Steals Documents, Wi-Fi Passwords, and Clipboard Data
Securonix details TASK#STOMP, a PowerShell backdoor stealing documents, Wi-Fi passwords, and clipboard data.
Securonix researchers disclosed TASK#STOMP, a campaign that uses wscript.exe to run an encoded VBScript and install a PowerShell backdoor. The malware harvests business documents, Wi-Fi passwords, clipboard contents, and screenshots, watches for new files, and accepts remote commands. Persistence uses disguised scheduled tasks plus a Startup-folder script, with redundant command-and-control at corecloudfileshare.xyz and attachmentsharingdrive.xyz. Initial access is unclear, though phishing is possible, and the chain later opens an Iranian government tenders site in Chrome.
- wscript.exe runs a randomly named desktop VBScript to start the chain.
- Persistence uses disguised scheduled tasks and Startup-folder script msdiag.vbs.
- PowerShell modules steal documents, Wi-Fi passwords, clipboard data, and screenshots.
- Redundant C2 domains are corecloudfileshare.xyz and attachmentsharingdrive.xyz.
- The chain timestomps files and later opens an Iranian tenders site in Chrome.
- ATT&CK
- T1059.005 Visual BasicT1059.001 PowerShellT1053.005 Scheduled TaskT1547.001 Registry Run Keys / Startup FolderT1115 Clipboard Data
- Products
- PowerShellWindowsGoogle Chrome
- Malware
- TASK#STOMP
- Organizations
- Securonix
- Countries
- Iran
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | attachmentsharingdrive.xyz | the same C2 infrastructure ("corecloudfileshare[.]xyz" or "attachmentsharingdrive[.]xyz"). Interestingly, the two components incorporate a mutual |
| domain | corecloudfileshare.xyz | h the modules communicate with the same C2 infrastructure ("corecloudfileshare[.]xyz" or "attachmentsharingdrive[.]xyz"). Interestingly, the t |
| domain | irantenders.com | Chrome in a maximized window and opens a specific URL from "irantenders[.]com," which hosts a searchable database of all tenders and co |
From the original article
3 min read at thehackernews.com
Cybersecurity researchers have disclosed details of a new campaign dubbed TASK#STOMP that delivers a PowerShell backdoor designed to harvest sensitive data from compromised hosts. The backdoor "automatically harvests and exfiltrates business documents, watches the filesystem for new files in real time, steals Wi-Fi passwords and clipboard contents, takes screenshots, and accepts arbitrary
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.