Cybersecurity researchers at **Securonix** have detailed a new and insidious campaign, **TASK#STOMP**, which utilizes a PowerShell backdoor to systematically steal sensitive information from infected hosts. ### Deep Dive into the Backdoor's Capabilities According to **Securonix** researchers **Akshay Gaikwad** and **Aaron Beardslee**, the backdoor is engineered for comprehensive data theft. It "automatically harvests and exfiltrates business documents, watches the filesystem for new files in real time, steals Wi-Fi passwords and clipboard contents, takes screenshots, and accepts arbitrary remote commands through two redundant, token-authenticated C2 servers." ### Initial Access and Evasion Tactics The infection chain commences with `wscript.exe` executing an encoded Visual Basic Script (VBScript) file, typically named randomly (e.g., `95c9050t66.vbs`) and staged on the victim's desktop. While the precise initial access vector remains unclear, phishing or social engineering are suspected. The use of random filenames is a deliberate tactic to bypass filename-based detection. The VBScript acts as the primary orchestrator, establishing persistence and launching subsequent malicious stages. ### Persistent Foothold and Stealth To ensure continuous access, the VBScript installer creates multiple scheduled tasks, cleverly named `Local Credential Manager`, `Network Audio Service`, `Windows Display Manager`, and `Device Credential Handler`. These names mimic legitimate operating system services to blend in and avoid suspicion. As a backup, the malware also places another script (`msdiag.vbs`) in the Windows Startup folder, ensuring execution upon user login. Further evasion techniques include forcing the termination of previous instances of the malware, **timestomping** (modifying timestamps to obscure malicious activity), hidden execution, and cleanup behaviors. These methods complicate forensic analysis and superficial administrative reviews.  ### The PowerShell Payload The attack proceeds with the execution of two hidden PowerShell commands: * `sys_loader.ps1`: Decodes `diag_pack.dat` and initiates the core functionalities, including document theft, system metadata collection, Wi-Fi password and clipboard content exfiltration, real-time file monitoring, screenshot capture, and arbitrary command execution. * `win_conn.ps1`: Decodes `win_conn_cfg.dat` to establish a secondary, persistent command-and-control (C2) channel, also capable of command execution and data collection. **Securonix** notes that "Running the modules as separate processes provides functional separation and operational redundancy: failure or termination of one branch does not immediately remove the other." Both modules communicate with the same C2 infrastructure, `corecloudfileshare[.]xyz` or `attachmentsharingdrive[.]xyz`, and even incorporate a mutual-watchdog mechanism to ensure continuous operation. ### Unexplained Web Action and Cleanup In a peculiar final stage, the VBScript orchestrator opens **Google Chrome** to a URL on `irantenders[.]com`, a site hosting government tender databases in Iran. The purpose of this user-facing action remains unknown. Concurrently, a batch script named `purge.bat` is launched, likely performing a cleanup to erase traces of the malicious activity after a two-second delay. However, the exact contents and actions of this script have not yet been recovered. ### Abusing Native Windows Components Researchers highlight the attackers' reliance on native Windows components: "Threat actors routinely abuse Windows Script Host, PowerShell, Task Scheduler, and the .NET toolchain to blend malicious execution with legitimate administrative activity." **TASK#STOMP** exemplifies this strategy by building a VBS-controlled framework that deploys multiple persistence anchors and offloads functionality to PowerShell and dynamically compiled C# code. This approach reduces the reliance on conventional executable payloads, making it significantly harder to distinguish malicious activity from benign system operations.