TASK#STOMP PowerShell Backdoor Steals Business Documents and Maintains Persistent Access

Security researchers at Securonix have detailed a Windows backdoor that combines PowerShell, Visual Basic scripts and scheduled tasks to maintain persistent access while continuously stealing business documents.

The malware, tracked as TASK#STOMP, is designed to blend into legitimate Windows activity. It creates four scheduled tasks with service-like names, installs a launcher in the Startup folder and backdates multiple files to January 2024. The campaign also stages its components inside a user-writable folder named WinDefendSvc, a label chosen to resemble Microsoft Defender infrastructure.

Securonix said the observed chain begins with a randomly named VBScript, but researchers have not confirmed how the file reached the victim. Possible delivery routes include phishing, browser downloads, removable media or remote access. That uncertainty matters because the initial access method could determine whether TASK#STOMP is part of a broader campaign or a narrowly targeted intrusion.

Once active, two hidden PowerShell modules decode payloads stored in Base64-formatted data files and execute them in memory. The backdoor scans fixed drives for Word documents, PDFs, PowerPoint files, spreadsheets and archives created or modified during the previous year. It can also monitor the filesystem for new documents, capture screenshots, read and clear clipboard contents, extract saved Wi-Fi passwords and run arbitrary PowerShell commands.

The malware communicates with two command-and-control servers and automatically fails over if one becomes unavailable. Runtime-compiled C# code disables TLS certificate validation, allowing the implant to communicate even when the server presents an invalid or mismatched certificate. Researchers said the confirmed activity appears focused on espionage and persistent collection, though unrestricted command execution could support additional malware or disruptive actions.

TASK#STOMP is notable less for a novel exploit than for how it assembles familiar Windows components into a resilient attack chain. Individual events, such as PowerShell execution or task creation, may appear routine when viewed in isolation.

For defenders, Securonix recommends correlating script-hosted task creation, hidden PowerShell launched from AppData, runtime C# compilation, timestomping and repeated Startup-folder execution. Removing a single scheduled task or process may not eradicate the infection because other persistence mechanisms can rebuild the chain. Responders should preserve task XML and staged payloads, terminate active scripts, remove every persistence anchor together, block the identified infrastructure and verify after reboot that the components do not return.