Ethical Hacking News
Task#STOMP is a highly sophisticated PowerShell backdoor that has been designed to harvest sensitive data from compromised hosts. The malware is capable of automatically harvesting and exfiltrating business documents, monitoring the filesystem for new files in real-time, stealing Wi-Fi passwords and clipboard content, taking screenshots, and executing arbitrary remote commands. This article provides a detailed analysis of the Task#STOMP malware, its propagation methods, and the potential risks it poses to organizations. With its advanced features and techniques, Task#STOMP is a significant threat to cybersecurity, and organizations must be vigilant in protecting themselves against this malicious campaign.
Task#STOMP is a sophisticated PowerShell backdoor that harvests sensitive data from compromised hosts. The malware delivers a backdoor called "diag_pack.dat" that can collect business documents, monitor the filesystem, steal Wi-Fi passwords and clipboard content, and execute arbitrary remote commands. The malware is believed to have originated from a Visual Basic Script (VBScript) file named "95c9050t66.vbs" and was likely delivered via email-based phishing or social engineering. The malware uses scheduled tasks and the Windows Startup folder to launch additional scripts and ensure persistence. The malware uses redundant persistence methods to guarantee continued execution even if one fails or is detected and removed. The malware sets up a secondary, persistent C2 channel with command execution and collection capabilities. The malware provides a pathway for continuous document collection, credential and clipboard theft, screenshot capture, redundant C2 communications, and arbitrary code execution. The purpose behind the final user-facing web action is unknown, but it may be related to the malware's ability to access a searchable database of government tenders and contracts.
The cybersecurity landscape has witnessed numerous breaches and exploits in recent years, with malware being a primary culprit behind these attacks. A recent discovery has shed light on an advanced PowerShell backdoor known as Task#STOMP, which has been designed to harvest sensitive data from compromised hosts. In this article, we will delve into the intricacies of the Task#STOMP malware, its propagation methods, and the potential risks it poses to organizations.
According to cybersecurity researchers at Securonix, Task#STOMP is a sophisticated malware campaign that delivers a PowerShell backdoor designed to collect sensitive information from infected hosts. The backdoor, which is named "diag_pack.dat," is capable of automatically harvesting and exfiltrating business documents, monitoring the filesystem for new files in real-time, stealing Wi-Fi passwords and clipboard content, taking screenshots, and executing arbitrary remote commands through two redundant, token-authenticated C2 servers.
The malware is believed to have originated from a Visual Basic Script (VBScript) file named "95c9050t66.vbs," which is executed by the "wscript.exe" file on the victim's desktop. The exact initial access pathway used to deliver the payload is unclear, but it is suspected that it may have been via email-based phishing or social engineering.
The VBScript functions as the orchestrator for establishing persistence on the host using scheduled tasks and launching subsequent stages. The tasks are given the names Local Credential Manager, Network Audio Service, Windows Display Manager, and Device Credential Handler, which are designed to blend in with regular operating system activity and avoid raising any red flags.
The VBScript installer also sets up a backup persistence method that uses the Windows Startup folder to launch another script payload ("msdiag.vbs") every time the user logs in to the system. In the next phase, the malware executes PowerShell commands to forcibly terminate previously running instances and ensure there exists only one active session.
These strategies, paired with deliberate timestamp modification (aka timestomping), hidden execution, and cleanup behavior, suggest a deliberate effort to get around superficial administrative reviews and complicate forensic analysis. The use of redundant persistence methods guarantees continued execution even if one of them fails or is detected and removed.
The next phase involves running a pair of hidden PowerShell commands - sys_loader.ps1 and win_conn.ps1. The sys_loader.ps1 command decodes "diag_pack.dat" and initiates the document-stealing, surveillance, and remote-access payload to steal system metadata, business documents, Wi-Fi passwords, and clipboard content. The win_conn.ps1 command decodes "win_conn_cfg.dat" and sets up a secondary, persistent C2 channel with command execution and collection capabilities.
"Running the modules as separate processes provides functional separation and operational redundancy: failure or termination of one branch does not immediately remove the other," Securonix said. Both the modules communicate with the same C2 infrastructure ("corecloudfileshare[.]xyz" or "attachmentsharingdrive[.]xyz").
Interestingly, the two components incorporate a mutual-watchdog relationship in which "diag_pack.dat" checks if "win_conn.ps1" is running, and restarts it if not, and vice versa. The end goal of the attack is to provide a pathway for continuous document collection, credential and clipboard theft, screenshot capture, redundant C2 communications, and arbitrary code execution, while leveraging an array of techniques to fly under the radar.
In the final stage, the VBScript orchestrator opens Google Chrome in a maximized window and opens a specific URL from "irantenders[.]com," which hosts a searchable database of all tenders and contracts issued by government departments and local authorities in Iran. The purpose behind this user-facing web action is unknown. Also launched is a batch script ("purge.bat") that invokes a two-second delay and likely performs a clean-up to erase traces of the malicious activity.
"Threat actors routinely abuse Windows Script Host, PowerShell, Task Scheduler, and the .NET toolchain to blend malicious execution with legitimate administrative activity," the researchers said. "TASK#STOMP demonstrates this approach through a VBS-controlled framework that installs multiple persistence anchors and delegates follow-on functionality to PowerShell and dynamically compiled C# code. By relying almost entirely on native Windows components, the operation reduces its dependence on conventional executable payloads and makes individual events more difficult to distinguish from benign system activity."
Related Information:
https://www.ethicalhackingnews.com/articles/Unveiling-the-TaskSTOMP-Malware-A-Comprehensive-Analysis-of-the-Advanced-PowerShell-Backdoor-ehn.shtml
https://thehackernews.com/2026/09/taskstomp-powershell-backdoor-steals.html
Published: Mon Sep 21 12:28:45 2026 by llama3.2 3B Q4_K_M
