- Security researchers have uncovered a new campaign dubbed TASK#STOMP that deploys a PowerShell backdoor on compromised systems.
- The malware steals business documents, Wi-Fi passwords, and clipboard contents while taking screenshots and accepting remote commands via two redundant C2 servers.
- The attack chain relies on VBScript, scheduled tasks, and the Windows Startup folder for persistence, using native system tools to evade detection.
Cybersecurity researchers have disclosed details of a new campaign dubbed TASK#STOMP that delivers a PowerShell backdoor designed to harvest sensitive data from compromised hosts, as reported on September 21, 2026. The backdoor “automatically harvests and exfiltrates business documents, watches the filesystem for new files in real time, steals Wi-Fi passwords and clipboard contents, takes screenshots, and accepts arbitrary remote commands through two redundant, token-authenticated C2 servers,” according to Securonix researchers.
The starting point of the infection chain is the use of “wscript.exe” to execute an encoded Visual Basic Script (VBScript) file staged on the victim’s desktop (“95c9050t66.vbs”). The exact initial access pathway used to deliver the payload is unclear, although it’s possible that it may have been via email-based phishing or social engineering. By giving it a completely random file name, it’s suspected that the intention may have been to evade file name-based detection mechanisms.
The VBScript functions as the orchestrator for establishing persistence on the host using scheduled tasks and launching subsequent stages. The tasks are given the names Local Credential Manager, Network Audio Service, Windows Display Manager, and Device Credential Handler so as to blend in with regular operating system activity and avoid raising any red flags.
Meanwhile, the VBScript installer also sets up a backup persistence method that uses the Windows Startup folder to launch another script payload (“msdiag.vbs”) every time the user logs in. Consequently, the malware executes PowerShell commands to forcibly terminate previously running instances and ensure there exists only one active session. These strategies, paired with deliberate timestamp modification (aka timestomping), hidden execution, and cleanup behavior, suggest a deliberate effort to get around superficial administrative reviews and complicate forensic analysis. The use of redundant persistence methods guarantees continued execution even if one of them fails or is detected and removed.
The next phase involves running a pair of hidden PowerShell commands: sys_loader.ps1 decodes “diag_pack.dat” and initiates the document-stealing, surveillance, and remote-access payload, while win_conn.ps1 decodes “win_conn_cfg.dat” and sets up a secondary, persistent C2 channel. “Running the modules as separate processes provides functional separation and operational redundancy: failure or termination of one branch does not immediately remove the other,” Securonix said.
Both modules communicate with the same C2 infrastructure (“corecloudfileshare[.]xyz” or “attachmentsharingdrive[.]xyz”). Interestingly, the two components incorporate a mutual-watchdog relationship in which “diag_pack.dat” checks if “win_conn.ps1” is running, and restart it if not, and vice versa. In the final stage, the VBScript orchestrator opens Google Chrome in a maximized window and opens a specific URL from “irantenders[.]com,” which hosts a searchable database of all tenders and contracts issued by government departments and local authorities in Iran; the purpose behind this user-facing web action is unknown. Also launched is a batch script (“purge.bat”) that invokes a two-second delay and likely performs a clean-up to erase traces of the malicious activity. “Threat actors routinely abuse Windows Script Host, PowerShell, Task Scheduler, and the .NET toolchain to blend malicious execution with legitimate administrative activity,” the researchers said.
✅ Follow BITNEWSBOT on Telegram, Facebook, LinkedIn, X.com, and Google News for instant updates.
