TASK#STOMP Backdoor Steals Business Files, Wi-Fi Passwords, and Screenshots
A new Windows backdoor named TASK#STOMP is actively exfiltrating business documents, capturing sensitive credentials, and performing surveillance on infected systems.
Researchers have detailed a sophisticated Windows backdoor, dubbed TASK#STOMP, capable of a wide range of malicious activities including the theft of business documents, Wi-Fi credentials, and sensitive user information. The malware's primary objective appears to be corporate espionage, as it actively searches victim drives for documents, uploads them to attacker-controlled servers, and continues to monitor for and exfiltrate any newly created or modified files.
Beyond document theft, TASK#STOMP exhibits broader surveillance capabilities. It is designed to capture saved Wi-Fi passwords, exfiltrate clipboard data, and take screenshots of the user's activity. Furthermore, the backdoor allows operators to remotely execute arbitrary commands on compromised systems, providing them with extensive control.
The infection chain begins with a VBScript file, often delivered via phishing emails containing attachments like ZIP or ISO files. This script then establishes persistence by creating four scheduled tasks, masquerading as legitimate Windows components such as "Network Audio Service," and copying itself into the Startup folder. The malware's files are typically placed in a folder named "WinDefendSvc," mimicking a Windows Defender service to evade detection.
Researchers from Securonix Threat Research analyzed one infected machine, making it difficult to ascertain the full scope of the campaign. However, they warn that the malware employs multiple persistence mechanisms, with at least five footholds including four scheduled tasks and a copy in the Startup folder. Removing only one of these may allow the others to re-establish the infection.
Two hidden PowerShell modules are central to TASK#STOMP's operations: one responsible for locating and stealing documents, and the other maintaining a communication channel with the attackers. These modules are designed to restart each other if one fails, though a shared bug in their watchdog logic limits the effectiveness of this redundancy.
Attribution for TASK#STOMP remains elusive, as its code, infrastructure, and tactics, techniques, and procedures (TTPs) do not cleanly align with any known advanced persistent threat (APT) groups. However, the prioritization of document types—Word, PDF, PowerPoint, and Excel over archives—strongly suggests a focus on corporate intelligence gathering rather than general cybercrime.
The malware's operational timeline is obscured by an anti-forensic technique where it backdates its own files to January 15, 2024. This fabricated date is intended to mislead forensic analysis and does not indicate the actual start of the campaign. The researchers noted that the malware opens a web page with an "IranTenders" theme, hinting at potential targeting of organizations involved in procurement or trade, though this is not conclusive evidence of regional or sector-specific targeting.
Security recommendations include blocking or alerting on Windows Script Host execution from common user directories like Desktop or Downloads, restricting script host usage for standard users, and implementing robust email gateway defenses against ISO, IMG, and VBS attachments. The use of a static, hardcoded authentication token provides a durable network indicator for detection and potential future incident clustering.
This new report details the infection chain, which begins with an encoded Visual Basic Script (VBScript) file executed by 'wscript.exe'. The VBScript establishes persistence using scheduled tasks with innocuous names like 'Local Credential Manager' and also sets up a Windows Startup folder backup. Furthermore, the malware employs timestomping and hidden execution techniques to evade detection and complicate forensic analysis, alongside redundant persistence methods to ensure continued operation.