Source: The Hacker News
Author: info@thehackernews.com (The Hacker News)
URL: https://thehackernews.com/2026/09/taskstomp-powershell-backdoor-steals.html
ONE SENTENCE SUMMARY:
TASK#STOMP is a VBScript-orchestrated, PowerShell-based backdoor campaign enabling stealthy persistence, surveillance, credential theft, document exfiltration, and redundant C2.
MAIN POINTS:
- Campaign deploys a PowerShell backdoor for data theft and remote command execution.
- Infection begins with wscript.exe running an encoded VBScript staged on the desktop.
- Initial delivery vector is unclear, possibly phishing or social engineering via email.
- Randomized VBScript filename likely aims to evade simple name-based detections.
- Persistence established through scheduled tasks masquerading as legitimate Windows services.
- Backup persistence uses Startup folder to run msdiag.vbs at user logon.
- Malware kills prior instances to enforce a single active session.
- Stealth techniques include timestomping, hidden execution, and trace-cleanup behaviors.
- Two PowerShell modules provide redundancy, mutual watchdogging, and separate C2 channels.
- C2 domains corecloudfileshare[.]xyz and attachmentsharingdrive[.]xyz use token-authenticated communications.
TAKEAWAYS:
- Native Windows tooling abuse can make malicious activity resemble routine administration.
- Layered persistence significantly increases resilience against partial remediation.
- Mutual watchdog processes help maintain long-lived access despite interruptions.
- Collection focuses on business documents, Wi‑Fi credentials, clipboard data, and screenshots.
- Unusual user-facing actions (opening Iran tenders site) may indicate staging, distraction, or operator workflow.