TASK#STOMP: Securonix-details Windows PowerShell backdoor stealing documents, Wi-Fi passwords, clipboard data, and screenshots via five persistence footholds

Securonix researchers disclose TASK#STOMP, a PowerShell-based Windows backdoor that maintains five persistence footholds, steals business documents and credentials, and exfiltrates through dual token-authenticated C2 servers, with attribution and initial…

Securonix researchers — named by Help Net Security as Akshay Gaikwad and Aaron Beardslee — disclosed TASK#STOMP, a Windows backdoor. The Hacker News, GBHackers, and Cyber Security News describe the payload as PowerShell-based, while Help Net Security calls it a Windows backdoor without specifying the language. The chain begins when wscript.exe executes an encoded, randomly named VBScript (The Hacker News; Cyber Security News calls it a randomly named VBS installer), which stages under %LOCALAPPDATA%\WinDefendSvc (GBHackers) and installs two hidden PowerShell modules that watch and restart each other. Persistence uses five footholds: four scheduled tasks disguised as Windows components — built from XML files per Cyber Security News, with names that rotate to defeat name-based detection per GBHackers — plus a Startup-folder script, identified by The Hacker News as msdiag.vbs, that can restore removed components on sign-in. Files are timestomped, with Cyber Security News dating them to January 15, 2024. The modules search fixed drives for business documents — Word, PDF, PowerPoint, Excel, then archives, in that priority order per Help Net Security — restricted per GBHackers and Cyber Security News to files under 500 MB and, per Cyber Security News, changed within the past year. They also capture screenshots, dump stored Wi-Fi passwords via netsh, harvest clipboard text, watch for new files, and execute operator commands including arbitrary PowerShell via Invoke-Expression. An Add-Type helper compiles C# at runtime via csc.exe to disable TLS certificate validation. Exfiltration uses failover between token-authenticated C2 servers corecloudfileshare[.]xyz and attachmentsharingdrive[.]xyz that accept invalid TLS certificates; Help Net Security flags a hardcoded static authentication token as a high-confidence network IOC. Attribution is withheld: Help Net Security says an 'IranTenders'-themed decoy domain suggests procurement- or Iran-related trade targeting (unconfirmed), while The Hacker News reports the chain later opens an Iranian government tenders site in Chrome. On initial access, Help Net Security deems phishing with ZIP or ISO/IMG attachments likely, but The Hacker News and GBHackers state the vector is unconfirmed; Help Net Security adds that reused buggy code points to a competent mid-tier operator rather than a mature APT.

• Disclosed by Securonix researchers Akshay Gaikwad and Aaron Beardslee (Help Net Security).
• Entry point: wscript.exe runs an encoded, randomly named VBScript; the installer stages under %LOCALAPPDATA%\WinDefendSvc.
• Five persistence footholds: four scheduled tasks disguised as Windows components (XML-built, with rotating names) plus a Startup-folder script (msdiag.vbs) that can restore removed components on sign-in.
• Data theft: Word, PDF, PowerPoint, Excel, and archive documents (under 500 MB, changed within the past year), Wi-Fi passwords via netsh, clipboard text, and screenshots.
• Two hidden PowerShell modules watch and restart each other and execute arbitrary commands via Invoke-Expression.
• Add-Type compiles C# at runtime via csc.exe to disable TLS certificate validation.
• Dual token-authenticated C2 with failover: corecloudfileshare[.]xyz and attachmentsharingdrive[.]xyz, accepting invalid TLS certificates; the hardcoded auth token is a durable network IOC.
• Timestomping sets file timestamps to January 15, 2024 (Cyber Security News).