How does TASK#STOMP achieve persistence on a compromised host?

It creates scheduled-task entries with legitimate-sounding names, drops a script in the Startup folder, and uses timestamp manipulation to hide its artifacts.

What network indicators can defenders monitor for?

DNS queries to corecloudfileshare.xyz or attachmentsharingdrive.xyz and outbound PowerShell traffic decoding diag_pack.dat and win_conn_cfg.dat.

TASK#STOMP PowerShell backdoor steals docs, Wi-Fi passwords

TASK#STOMP PowerShell backdoor steals documents, Wi-Fi passwords, and clipboard data

The latest Securonix brief describes a multi-stage PowerShell backdoor, TASK#STOMP, that first appeared on September 21 2026. The campaign relies exclusively on native Windows utilities—WScript, PowerShell, Task Scheduler, and the .NET runtime—to harvest business documents, Wi-Fi credentials, clipboard contents, and screenshots while maintaining two redundant, token-authenticated C2 channels. This opening directly answers the core query: what the TASK#STOMP PowerShell backdoor does and how it operates.

Initial infection vector and VBS orchestrator

An encoded Visual Basic Script (95c9050t66.vbs) is executed via wscript.exe. Delivery is typically a phishing attachment or malicious link.
The VBS creates scheduled-task entries named Local Credential Manager, Network Audio Service, Windows Display Manager, and Device Credential Handler to blend with legitimate services.
A secondary persistence method copies msdiag.vbs into the Windows Startup folder, guaranteeing execution on every user logon.
Timestamp modification (timestomping) obscures creation dates, complicating forensic timelines.

PowerShell payload architecture and functional separation

Two hidden PowerShell scripts are launched:
1. sys_loader.ps1 decodes diag_pack.dat and activates modules for document harvesting, Wi-Fi password extraction, clipboard capture, and screenshot collection.
2. win_conn.ps1 decodes win_conn_cfg.dat and establishes a persistent secondary C2 channel.
Running the modules as separate processes provides operational redundancy; if one branch crashes, the other continues to function.
Both scripts communicate with the same C2 domains: corecloudfileshare.xyz and attachmentsharingdrive.xyz.
A mutual-watchdog relationship monitors each script, restarting the counterpart if it terminates.

Data-exfiltration capabilities of the TASK#STOMP PowerShell backdoor

Document harvesting: Real-time monitoring of the filesystem copies newly created or modified files to the C2 server.
Wi-Fi credential theft: Extraction of stored wireless profiles, including SSIDs and clear-text passwords, from the Windows WLAN store.
Clipboard capture: Periodic reads of the clipboard buffer collect copied credentials or proprietary data.
Screenshot capture: Full-screen grabs are taken at regular intervals and sent to the attacker.
Arbitrary command execution: Attackers can issue PowerShell commands through the C2 channel, enabling lateral movement or further payload delivery.

Cleanup, evasion tactics, and anti-forensics

After activation, a batch file purge.bat runs a short delay before attempting to erase traces of malicious activity. The exact commands are unknown, but the dedicated cleanup script highlights a focus on anti-forensics.
The VBS orchestrator also launches Google Chrome in a maximized window pointing to irantenders.com—a site hosting Iranian government tender data. This may serve as a decoy, a credential-phishing lure, or a means to generate network noise.
Timestamp manipulation and the use of legitimate-sounding task names aim to bypass both signature-based AV and heuristic monitoring tools.

Mitigation and detection guidance

Endpoint monitoring: Alert on creation of scheduled tasks with the names listed above, especially if the task runs wscript.exe or PowerShell with encoded arguments.
File-integrity monitoring: Deploy integrity checks on the Startup folder and user desktops to detect unknown VBS or batch files.
Network indicators: Block DNS resolution to corecloudfileshare.xyz and attachmentsharingdrive.xyz; inspect outbound PowerShell traffic for base64-encoded payloads.
Credential hygiene: Enforce WPA2-Enterprise or WPA3 for Wi-Fi networks and regularly rotate stored wireless profiles.
Patch posture: Apply the latest Windows updates, particularly those addressing PowerShell logging and script execution policies.
For a broader view of how native Windows components are abused in recent campaigns, see the analysis of the Cisco 0-Day Vulnerability Exposes Users to Remote Exploitation.
Additional guidance from the Cybersecurity and Infrastructure Security Agency (CISA) can be found at CISA.

Threat actor profile and attribution clues

The reliance on native Windows tooling mirrors tactics used by financially motivated groups targeting enterprise environments in the Middle East.
The use of an Iranian tender site as a user-facing URL suggests a regional focus or an attempt to legitimize traffic for victims dealing with Iranian entities.
No explicit ransomware or extortion demand was observed; the primary value appears to be continuous data exfiltration for intelligence or credential resale.

What to watch next

C2 evolution: The dual-domain setup may expand to additional fast-flux or cloud-based hosts, complicating blocklists.
Payload diversification: Given the modular design, future iterations could embed additional modules for credential dumping or ransomware deployment.
Supply-chain risk: The reliance on PowerShell and .NET compilation may lead threat actors to embed similar loaders in legitimate software updates.

The TASK#STOMP PowerShell backdoor underscores the danger of script-based malware that blends seamlessly with routine administrative activity. Organizations should tighten script execution policies, enhance visibility into scheduled-task creation, and monitor for the specific network indicators disclosed by Securonix. Continuous threat-intel integration remains essential to detect and disrupt such stealthy, multi-stage operations.

Related coverage

Explore more on this topic

More malware-analysis coverage