TASK#STOMP Malware Uses Windows Tools to Steal Sensitive Enterprise Data

Security researchers have uncovered TASK#STOMP, a Windows backdoor using hidden PowerShell commands, VBScript installers, and scheduled tasks to harvest sensitive business files, Wi-Fi keys, and clipboard data across compromised systems while maintaining redundant command-and-control servers.

Malware operators are increasingly stripping custom executables out of their playbooks and trading them for the native administrative tools already sitting on target machines.

Disclosed by Securonix researchers Akshay Gaikwad and Aaron Beardslee, the threat bypasses traditional signature detection by blending malicious execution directly with normal operating system activity according to disclosures shared with security publishers.

How the TASK#STOMP Infection Chain Takes Root

Every deployment begins with a randomly named Visual Basic Script file stored on the victim desktop under the identifier 95c9050t66.vbs. Investigators have not yet confirmed the precise initial access vector, noting that delivery could stem from email-based phishing, browser downloads, removable media, or social engineering maneuvers.

Once launched via wscript.exe, the script acts as an orchestrator, setting up multiple persistence anchors so that removing a single component will not break the malware’s grip on the machine. It deploys four scheduled tasks designed to blend into standard administrative output. These tasks carry names like Local Credential Manager, Network Audio Service, Windows Display Manager, and Device Credential Handler.

As a secondary insurance policy against discovery, the installer drops a copy named msdiag.vbs straight into the Windows Startup folder to guarantee execution every time a user signs in. Before any payload activates, the malware forcibly terminates older instances of itself to maintain a single active session, modifying file timestamps back to January 15, 2024, to complicate forensic reviews.

Dual PowerShell Branches and Redundant C2 Channels

The operational engine of TASK#STOMP runs on two distinct PowerShell branches that divide the workload while keeping each other alive. One branch executes sys_loader.ps1 to decode an encrypted data file named diag_pack.dat, which governs document discovery and active surveillance. The second branch runs win_conn.ps1 to decode win_conn_cfg.dat and establish a secondary command-and-control connection.

TASK#STOMP Malware Uses Windows Tools to Steal Sensitive Enterprise Data — Photo: thehackernews.com

Running the modules as separate processes provides functional separation and operational redundancy: failure or termination of one branch does not immediately remove the other.

Espionage Groups Use BlueMoon Exploit Kit to Target Chrome and Windows
Securonix researchers Akshay Gaikwad and Aaron Beardslee

The two components maintain a mutual watchdog relationship. If one script stops running, the other restarts it automatically. Both modules communicate through identical infrastructure hosted at corecloudfileshare[.]xyz or attachmentsharingdrive[.]xyz. When outbound requests fail against one server, the malware automatically shifts traffic to the alternative address using a static authentication header.

Active Data Harvesting and System Surveillance

The primary module runs a continuous search across fixed drives for Word documents, PDF files, PowerPoint presentations, Excel sheets, and compressed archives. It favors files modified within the past year while skipping oversized documents exceeding 500 MB. A real-time file system watcher catches subsequent modifications instantly.

Beyond office documents, the backdoor extracts saved wireless profiles in plain text by executing native Windows netsh commands. It grabs and clears clipboard text, captures screenshots on demand, and compiles tiny C# helpers at runtime through the legitimate compiler csc.exe to bypass invalid TLS certificates during server handshakes.

Observed Cleanup Actions and Unanswered Questions

At the conclusion of the automated deployment sequence, the VBScript orchestrator launches Google Chrome in a maximized window to visit a specific URL hosted on irantenders[.]com, a searchable database covering public tenders and government contracts in Iran. Security analysts have not determined why the malware directs browsers to this particular site.

Windows has a hidden malware removal tool | #shorts #trending #mrt #malware

A companion batch script, purge.bat, then executes with a two-second delay intended to erase local traces. Because its contents were not recovered before cleanup, investigators continue to examine the exact scope of the final purge phase while urging SOC teams to preserve task XML files and analyze PowerShell script block logs for signs of hidden compiler activity.

Worth a look