The TASK#STOMP Windows backdoor takes Wi-Fi passwords, screenshots, and business files
Securonix dissects TASK#STOMP, a Windows backdoor exfiltrating business documents, Wi-Fi passwords, screenshots, and clipboard data via five persistence footholds.
Securonix researchers Akshay Gaikwad and Aaron Beardslee analyzed TASK#STOMP, a Windows backdoor that starts from a VBScript and plants four scheduled tasks mimicking Windows components plus a Startup-folder copy. Two hidden PowerShell modules steal documents in priority order (Word, PDF, PowerPoint, Excel, then archives), maintain a C2 channel with a backup server, and restart each other; the malware also grabs saved Wi-Fi passwords, clipboard text, and screenshots. Attribution is withheld, but an 'IranTenders'-themed decoy domain suggests procurement or Iran-related trade targeting, and a static hardcoded authentication token is a high-confidence network IOC. Likely delivery is a phishing email with ZIP or ISO/IMG attachments.
- Backdoor exfiltrates Word/PDF/PPT/Excel documents, Wi-Fi passwords, clipboard text, and screenshots.
- Five persistence footholds: four scheduled tasks plus a Startup folder copy that can rebuild infections.
- Paired PowerShell modules watch each other; hardcoded auth token is a durable network IOC.
- 'IranTenders' decoy domain suggests tender/procurement-themed targeting, unconfirmed.
- No attribution; reused buggy code points to a competent mid-tier operator, not a mature APT.
- ATT&CK
- T1053.005 Scheduled Task/Job: Scheduled TaskT1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup FolderT1059.001 Command and Scripting Interpreter: PowerShellT1113 Screen CaptureT1115 Clipboard Data
- Organizations
- Securonix
From the original article
4 min read at helpnetsecurity.com
Researchers have taken apart TASK#STOMP, a Windows backdoor that searches a victim’s drives for business documents, uploads them to attacker servers, and then stays put to grab each new or edited document. The same malware steals saved Wi-Fi passwords and clipboard text, takes screenshots, and runs whatever command its operators send.
By Mirko Zorz · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.