TASK#STOMP campaign uses PowerShell backdoor for data theft

As reported by The Hacker News, Securonix researchers have uncovered a new campaign named TASK#STOMP that employs a sophisticated PowerShell backdoor to steal sensitive information from targeted systems. The backdoor is designed to automatically harvest and exfiltrate business documents, monitor file system changes in real-time, steal Wi-Fi passwords and clipboard contents, capture screenshots, and execute remote commands.

The TASK#STOMP campaign begins with an encoded Visual Basic Script (VBScript) executed by wscript.exe, with the initial access vector likely being phishing or social engineering. The VBScript establishes persistence using scheduled tasks with names mimicking legitimate system processes, such as "Local Credential Manager" and "Network Audio Service." A secondary persistence method involves the Windows Startup folder. The malware then executes PowerShell commands to ensure only a single instance is active, employing techniques like timestomping and hidden execution to evade detection and complicate forensic analysis.

Two PowerShell scripts, sys_loader.ps1 and win_conn.ps1, are responsible for decoding payloads that steal system metadata, business documents, Wi-Fi passwords, and clipboard data, while also establishing redundant command and control (C2) channels. These modules communicate with C2 servers like corecloudfileshare[.]xyz and attachmentsharingdrive[.]xyz, featuring a mutual watchdog mechanism for operational redundancy. The campaign's ultimate goal is continuous data collection and remote access, with a final stage involving the opening of a specific URL related to Iranian government tenders, followed by a cleanup script whose exact function remains unknown. The use of native Windows components highlights a trend in threat actor tactics to blend malicious activity with legitimate system operations.

Source: The Hacker News