TASK#STOMP PowerShell Backdoor Steals Business Documents and Executes Remote Commands

A Windows-focused backdoor dubbed TASK#STOMP that uses VBScript, PowerShell, Scheduled Tasks, and runtime C# compilation to establish resilient persistence and continuously steal business documents.

The implant also captures screenshots, extracts saved Wi-Fi passwords, harvests clipboard data, and executes arbitrary commands received from its operators.

While the original delivery method is unconfirmed, the location is consistent with payloads introduced through phishing attachments, browser downloads, archive extraction, removable media, or manual execution.

Securonix emphasized that process telemetry alone cannot establish the initial-access vector.

The VBScript acts as the installer and operational controller. It creates a staging directory under %LOCALAPPDATA%\WinDefendSvc, a name designed to resemble a legitimate Windows Defender related service, and registers four scheduled tasks from XML definitions stored in that directory.

The tasks use trusted-sounding names such as “Local Credential Manager,” “Network Audio Service,” “Windows Display Manager,” and “Device Credential Handler.”

On subsequent executions, TASK#STOMP can reuse the same task XML files while rotating the visible task names, undermining detections that rely only on scheduled-task names.

The malware also copies msdiag.vbs into the current user’s Startup folder.

This gives the operation an additional persistence path independent of Task Scheduler: when the user signs in, Windows Script Host can relaunch the VBS component, recreate removed tasks, replace inactive processes, and restart its PowerShell payloads.

Researchers noted that removing a single foothold may not remove the infection because the remaining mechanisms can restore it.

TASK#STOMP launches two hidden PowerShell modules, sys_loader.ps1 and win_conn.ps1, with -NoProfile, -ExecutionPolicy Bypass, and -WindowStyle Hidden.

Before doing so, the installer enumerates running processes and terminates older instances whose command lines contain sys_loader or win_conn, then relaunches clean copies.

Securonix analyzed that, the campaign begins with an encoded VBScript, observed as 95c9050t66.vbs, launched by wscript.exe from a user-accessible Desktop path.

TASK#STOMP PowerShell Backdoor

The scripts decode Base64 content from .dat files, including diag_pack.dat and win_conn_cfg.dat, and execute the recovered PowerShell code in memory.

Querying Win32_Process allows the script to inspect complete command lines rather than relying only on generic process names such as powershell.exe.

This is not fully fileless malware, because the encoded payloads remain on disk, but the plaintext backdoor does not need to be written as a PowerShell script before execution.

The primary module searches fixed drives for business-relevant files, including Word documents, PDFs, PowerPoint files, Excel spreadsheets, and archives.

It prioritizes recent files, skips large files above 500 MB, tracks previously uploaded data, and continues collecting newly created or modified documents through filesystem monitoring.

Both PowerShell branches communicate with two token-authenticated command-and-control servers: corecloudfileshare[.]xyz and attachmentsharingdrive[.]xyz. If one server fails, the malware switches to the other, providing basic operational resilience.

The modules poll for commands, transmit results, upload stolen data, and maintain local victim and transfer-tracking files.

A notable component of the operation is its use of PowerShell Add-Type to compile C# at runtime through the legitimate .NET csc.exe compiler.

The compiled helper turns off TLS certificate validation, allowing the backdoor to communicate even if the attacker infrastructure uses invalid, self-signed, expired, or hostname-mismatched certificates.

Each PowerShell branch produces its own powershell.exe → csc.exe → cvtres.exe execution chain.

Decoded payloads show TASK#STOMP supports far more than document theft.

Operators can issue commands to capture the primary display, retrieve Wi-Fi passwords using netsh, collect and clear clipboard text, retrieve host information, and execute arbitrary PowerShell commands through Invoke-Expression.

Although the observed configuration is focused on espionage and persistent data collection, unrestricted command execution could be used to deploy additional malware, steal credentials, move laterally, or initiate destructive actions after the initial compromise.

Defenders should prioritize correlation rather than isolated indicators: hidden PowerShell running from a user-writable AppData directory, Base64 decoding into ScriptBlocks.

Add-Type calls that disable certificate validation, powershell.exe spawning csc.exe, suspicious task XML stored under %LOCALAPPDATA%, and PowerShell invoking netsh wlan … key=clear are high-value signals.

Preserving scheduled-task XML, Startup-folder scripts, PowerShell Script Block Logging, AMSI telemetry, compiler artifacts, and staged .dat files is critical before remediation.

Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC