Do Son 
At a Glance
| Attribute | Details |
|---|---|
| Malware Family | TASK#STOMP |
| Threat Actor | Unknown (Unconfirmed attribution) |
| Target Victims | Enterprise networks and corporate document repositories |
| Delivery Vector | Deceptive VBScript execution (initial delivery under investigation) |
| Key Capabilities | Continuous document theft, Wi-Fi password theft, clipboard capture, C2 failover |
| Source | Securonix Threat Research |
Executive Summary
The newly discovered malware framework establishes persistent access on compromised Windows endpoints through scheduled tasks and startup files. Additionally, the implant executes dual PowerShell modules that steal sensitive corporate files and accept remote operator commands. Security teams must monitor native script executions because the attack uses legitimate administrative binaries.
Delivery and Initial Execution
The attack sequence begins with a standalone VBScript file located on the victim’s desktop. Investigators note that the initial access method remains unconfirmed. However, attackers often distribute similar scripts through spear-phishing emails or malicious web downloads.
Once executed, the script initializes a staging folder inside the local application data path. Specifically, it builds a directory named WinDefendSvc to mimic standard system processes. Next, the script terminates any prior running instances to avoid process conflicts. It queries Windows Management Instrumentation to locate existing payloads and stops them immediately.
Afterward, the installer executes a cleanup batch script to cover its tracks. This script pauses for two seconds before deleting temporary setup files. Meanwhile, the installer launches Google Chrome and displays an Iranian tender web page. This browser action may serve as a visual distraction while background modules install.
Infection Chain Architecture
The framework establishes several layers of persistence to survive system reboots. First, it registers four separate scheduled tasks using custom XML templates. The malware uses misleading task names that imitate core Windows audio and display components. Furthermore, subsequent executions rotate these task names to confuse system administrators during forensic audits.
In addition, the script places a persistent VBScript launcher directly into the user Startup folder. This secondary launcher ensures the malware restarts whenever a user signs into the computer. Therefore, the threat maintains continuous execution even if administrators delete individual scheduled tasks.
Next, the malware modifies file timestamps across five core artifacts. It backdates these files to January 15, 2024. Consequently, this timestomping technique prevents forensic analysts from identifying recently modified files.
The framework then launches two separate hidden PowerShell branches. As the primary report highlights: ‘The most distinctive behavior is the combination of rotating service-like task names, Startup-folder redundancy, fixed-date timestomping, controlled process replacement, dual PowerShell branches, and separate runtime-compilation events.’
Both PowerShell instances invoke the native C# compiler to process embedded networking helpers. These runtime helpers disable Transport Layer Security certificate validation checks. Thus, the malware communicates with remote servers even if those servers use invalid or self-signed certificates.
Command-and-Control and Exfiltration
The TASK#STOMP PowerShell backdoor uses these dual modules to split operational duties and maximize reliability. The first module decodes an encrypted data file to activate the primary collection payload. It searches all fixed drives for business documents created or modified within the past 365 days. Specifically, it targets text documents, spreadsheets, presentations, and compressed archives.
Furthermore, the module registers a filesystem watcher to detect new files in real time. Whenever a user creates or alters a target document, the malware queues the file for exfiltration. The payload compresses files larger than ten megabytes before transmitting them over HTTP requests.
Meanwhile, the second PowerShell module maintains an always-on remote access channel. It regularly polls command servers for operator instructions and sends back system status reports. The backdoor executes built-in commands to capture desktop screenshots, harvest clipboard text, and extract saved Wi-Fi passwords. If an operator submits an unrecognized command, the backdoor executes the instruction directly via PowerShell.
Both modules authenticate to two external servers using a single static authentication token. If the primary server fails to respond, the script switches to the backup server. Researchers noted: ‘Although the confirmed payload is primarily focused on espionage and persistent collection rather than immediate destruction, its unrestricted command-execution capability gives an operator a direct path to deploy additional malware, steal more credentials, or initiate disruptive activity.’
Threat Actor Attribution
Securonix researchers have not formally attributed this activity to a specific threat actor. Therefore, the attribution remains unconfirmed. The decoy web page displays Iranian government tender information, but this indicator does not confirm national origin. Threat actors frequently exploit legitimate third-party websites or deploy foreign lures to mislead investigators.
Defense and Detection Guidance
Organizations must apply behavioral detection rules to identify this stealthy activity. Security teams should monitor the creation of scheduled tasks originating from user application paths. In addition, administrators must enable PowerShell Script Block Logging to detect Base64 decoding patterns.
Defenders should watch for PowerShell processes spawning the native C# compiler. Legitimate administrative scripts rarely compile C# code dynamically inside user directories. Furthermore, network gateways should inspect outbound traffic for abnormal requests carrying custom authentication headers.
Because the new TASK#STOMP PowerShell backdoor uses redundant persistence, responders must remove all scheduled tasks and startup entries simultaneously. A partial remediation will allow remaining components to reinstall the entire backdoor framework.
Support Our Threat Intelligence
Find our threat intelligence and malware analysis helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
