TASK#STOMP Backdoor Masquerades as Windows Services to Steal Data — SkimNews
Get the Tech newsletter
Daily tech — startups, AI labs, chips, the launches that shape the next decade. Free.
- TASK#STOMP is a PowerShell backdoor disclosed by Securonix researchers Akshay Gaikwad and Aaron Beardslee that automatically harvests business documents, monitors the filesystem in real time, steals Wi-Fi passwords and clipboard contents, takes screenshots, and accepts remote commands via two token-authenticated C2 servers.
- The infection chain begins with wscript.exe executing an encoded VBScript file ("95c9050t66.vbs") on the victim's desktop, with researchers suspecting the initial access vector was email-based phishing or social engineering.
- Persistence is established via scheduled tasks deliberately named to blend in with legitimate Windows services — Local Credential Manager, Network Audio Service, Windows Display Manager, and Device Credential Handler — plus a backup mechanism using the Windows Startup folder ("msdiag.vbs") triggered on every user login.
- Two redundant modules — sys_loader.ps1 and win_conn.ps1 — run as separate processes with a mutual-watchdog relationship, communicating with C2 infrastructure at "corecloudfileshare[.]xyz" and "attachmentsharingdrive[.]xyz" so that termination of one branch does not remove the other.
- Anti-forensics techniques include timestomping, hidden execution, cleanup behavior, and forcibly terminating previously running instances to ensure only one active session remains, all designed to evade superficial administrative reviews and complicate forensic analysis.
- In the final stage, the VBScript orchestrator opens Google Chrome to irantenders[.]com, a searchable database of Iranian government tenders and contracts, in a maximized window — a user-facing action whose purpose remains unknown to researchers.
- A cleanup batch script ("purge.bat") with a two-second delay is launched to erase traces of the malicious activity, but its contents have not been recovered by investigators.
Why it matters: TASK#STOMP's reliance on native Windows components (PowerShell, VBScript, Task Scheduler, .NET) lets it blend malicious execution with legitimate administrative activity, making individual events harder to flag — defenders can't rely on spotting a single suspicious executable, and its four scheduled tasks plus a Startup-folder backup mean removing one persistence anchor won't stop the operation.
Ask SkimNews
