New TASK#STOMP Backdoor Uses PowerShell to Steal Documents and Wi-Fi Passwords

TASK#STOMP is a newly analyzed Windows backdoor that turns ordinary built-in tools into a durable spying operation.

It uses a Visual Basic Script installer, hidden PowerShell, scheduled tasks, and runtime code compilation to collect business documents, saved Wi-Fi passwords, clipboard data, and screenshots from compromised machines.

The observed infection begins with a randomly named VBS file in a user-accessible location. Its delivery route remains unconfirmed: the available evidence cannot distinguish phishing, a browser download, removable media, remote access, or an extracted archive. Once launched, the script builds several ways to survive a restart or partial cleanup.

Securonix said in a report shared with Cyber Security News (CSN) that its analysts decoded the final payloads and identified TASK#STOMP as a fully working PowerShell backdoor.

The research shows the operation is built for continued collection and remote control, rather than an immediately destructive attack.

That combination raises the risk for organizations holding sensitive files. Attackers can search every fixed drive for recent documents and archives, then keep watching for new or changed files.

The backdoor also accepts commands from its operators, leaving an infected computer open to further theft, additional malware, or disruptive actions. It also gathers system and network details for registration.

New TASK#STOMP Backdoor Uses PowerShell

The main module searches fixed drives for Word, PDF, PowerPoint, Excel, and archive files. It favors documents created or changed during the past year, skips files larger than 500 MB, and uploads selected material to its command servers.

A file watcher then monitors drives so later changes can be taken too. It also runs Windows netsh commands to list stored wireless profiles and expose their saved keys in plain text.

Clipboard content is copied, sent out, and cleared, while screenshots of the main display can be captured on command. These functions make TASK#STOMP a broad data-collection tool, similar to the credential-harvesting behavior discussed in Wi-Fi credential theft campaigns.

Two separate PowerShell branches divide the workload. One decodes the document-stealing payload, while the other maintains a second command channel with overlapping capabilities.

They can restart each other, and their servers fail over if one connection fails, helping the operator keep access when a process or network route is interrupted. The malware hides its network traffic behind a Chrome-like user agent and compiles small C# helpers within PowerShell.

Those helpers accept invalid TLS certificates, which can let the backdoor reach its servers even when certificate checks would normally stop the connection. The activity resembles other cases where PowerShell scripts deliver backdoors through native Windows components.

Persistence and Response Priorities

TASK#STOMP establishes four scheduled tasks from XML files stored under a user-writable AppData folder, then drops msdiag.vbs in the Startup folder.

The tasks use rotating names that resemble Windows services, making a quick review less reliable. This technique closely reflects the abuse covered in Windows task persistence techniques, where trusted scheduling features are turned into a long-term foothold.

Before relaunching its modules, the script ends earlier instances, changes several file timestamps to January 15, 2024, and starts PowerShell with hidden-window and execution-policy-bypass settings.

Both PowerShell processes then launch the legitimate C# compiler, csc.exe. This full sequence is far more useful to defenders than one filename or task name alone.

Security teams should investigate VBS or Windows Script Host processes that create tasks from AppData, especially when they are followed by hidden PowerShell and compiler activity.

PowerShell Script Block Logging, AMSI records, Task Scheduler logs, and endpoint file events can preserve the commands and temporary files needed to reconstruct the chain.

Comparable hidden PowerShell persistence activity has also shown why native tool misuse needs behavioral detection. Containment must be coordinated.

Teams should preserve task XML and staged files, stop active VBS and PowerShell processes, remove every scheduled task and Startup entry, block the confirmed infrastructure, and reboot to confirm nothing returns. Removing only one script or task may allow the remaining components to rebuild the infection.

Indicators of compromise (IoCs):-

Analyzed Files / Hashes

File Name	SHA256
95c9050t66.vbs	5251098838fab2f3192307cac99ad2d3a71b55ba1f256412d43a9dfb3b93ac58
msdiag.vbs	5251098838fab2f3192307cac99ad2d3a71b55ba1f256412d43a9dfb3b93ac58
task.xml	7a9e7b4c2f75f7de03838f5c9589148cdbefb76200ea3cf2d6f1a2288c302493
task2.xml	ff12c194128d0733434ce1580691bfde5896f14ba9f360c0f6c3a622eed24312
task3.xml	e46111264ebd91e80bbad85141d254930354faa0f15d3bbfaf4826adf5a53c8d
task4.xml	335d19f4e757e0c36c9ef1cb4638e151aac041b7814e3eb8bda6f78ff7011f32
sys_loader.ps1	103b4d4a666bc0a89c10c9df55f54f4be5fa111e8429c37ae14fa8f16cb50fe8
diag_pack.dat	02ba7c982b68ec8f5a1cb47c6f3969f3f2f38ea9b4ebb8833d1b8b0ba2ab1407
win_conn.ps1	8f448080cec5cba2f0ba6a960bc3425a2d99a6767464f581d13476985eaa4a2e
win_conn_cfg.dat	41231e7f5db49055dbe4246462e60077a67b1845696df3947eb1121fe392947f
purge.bat	bd200756b4e996a6e7cc63036aa760f9585f252c55a60cab12f29e389b96e0ef

C2 and Infrastructure

C2 Address
corecloudfileshare[.]xyz
attachmentsharingdrive[.]xyz

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC