Author: DigitalSpying Security Desk
Date: September 21, 2026
Executive Summary
In a compelling cyber espionage campaign demonstrating the high degree of stealth achievable by weaponizing native operating system tools, cybersecurity researchers from Securonix have detailed TASK#STOMP, a newly identified evasion-heavy malware framework. As reported by The Hacker News, the operation deploys a multi-stage, fileless PowerShell backdoor designed for persistent intelligence gathering, real-time document theft, Wi-Fi credential exfiltration, and arbitrary remote command execution.
To evade detection by modern security monitoring tools, TASK#STOMP employs aggressive anti-forensic techniques—including deliberate timestamp modification (timestomping), randomized file naming, and Scheduled Tasks disguised with authentic-sounding Windows service titles (such as "Local Credential Manager" and "Network Audio Service"). Crucially, the malware implements a resilient mutual-watchdog architecture: it divides operational duties across two parallel PowerShell processes that continuously monitor each other's execution states. If a security analyst or endpoint protection tool terminates one process, the surviving component immediately detects the absence and resurrects its partner. By executing entirely through built-in Windows components, TASK#STOMP minimizes its forensic footprint while establishing an extraordinarily durable foothold on victim hosts.
Deep-Dive Technical Analysis
1. Initial Access & The VBScript Orchestrator
The TASK#STOMP infection sequence is structured as a multi-stage Living-off-the-Land (LotL) execution pipeline:
* Script Staging: Initial execution commences when Windows Script Host (wscript.exe) runs an obfuscated Visual Basic Script (VBScript) file staged on the victim’s desktop (95c9050t66.vbs).
* Timestomping & Evasion: The installer alters the timestamps of all dropped script components, matching the creation and modification dates of legitimate core Windows DLLs located in C:\Windows\System32\ to evade basic chronology-based forensic scans.
* Redundant Persistence Framework:
* Primary Anchor: The orchestrator registers four distinct Scheduled Tasks disguised as legitimate system services: Local Credential Manager, Network Audio Service, Windows Display Manager, and Device Credential Handler.
* Secondary Fallback: The installer simultaneously writes a backup script (msdiag.vbs) to the user’s Windows Startup directory (shell:startup), ensuring execution upon user logon even if the scheduled tasks are purged.
+----------------------------------------------------------------------------------------------------+
| TASK#STOMP EXECUTION & MUTUAL WATCHDOG |
|---|
[Initial VBScript Trigger: wscript.exe 95c9050t66.vbs]
|
| 1. Modifies Timestamps (Timestomping) & Drops Scheduled Tasks
v
[Spawns Dual Parallel PowerShell Processes with Hidden Windows]
|
+----------------+----------------+
| |
v v
[Process A: sys_loader.ps1] [Process B: win_conn.ps1]
(Decodes diag_pack.dat) (Decodes win_conn_cfg.dat)
| |
|-- Real-Time Document Monitor |-- Redundant Token-Auth C2
|-- Wi-Fi Password Extraction |-- Remote Shell Execution
|-- Clipboard & Screen Capture |-- Backup Communications
| |
+<======= [MUTUAL WATCHDOG] ======>+
(Constantly verifies partner PID; resurrects partner if terminated)
|
v
[Exfiltrates Stolen Files & Credentials to corecloudfileshare[.]xyz]
2. The Mutual-Watchdog Architecture
Rather than maintaining a single monolithic implant that presents a single point of failure, TASK#STOMP separates functionality across two decoupled PowerShell modules:
* Component A (sys_loader.ps1): Decodes an encrypted configuration blob (diag_pack.dat) and handles data collection routines—including harvesting operating system metadata, enumerating business documents, and dumping credentials.
* Component B (win_conn.ps1): Decodes win_conn_cfg.dat to establish secondary, token-authenticated communication channels with remote command-and-control (C2) servers (corecloudfileshare[.]xyz and attachmentsharingdrive[.]xyz).
* The Self-Healing Loop: The two scripts maintain an active cross-monitoring watchdog loop. Component A periodically interrogates the Windows process table to ensure Component B is active, while Component B performs the reciprocal check. If an incident response team terminates sys_loader.ps1, win_conn.ps1 detects the missing process within seconds and re-launches the script, creating an endlessly reviving persistence loop.
3. Espionage Capabilities & Data Exfiltration
TASK#STOMP is purpose-built for comprehensive enterprise intelligence collection:
* Filesystem Event Watcher: Hooks filesystem creation and modification events in real time. Whenever a user saves or edits spreadsheets, presentations, or documents (.docx, .xlsx, .pdf), the script stages a copy for automated exfiltration.
* Wi-Fi Credential Extraction: Executes native netsh wlan show profiles commands with key=clear, systematically recovering all stored Wi-Fi network passphrases.
* Clipboard & Screen Surveillance: Continuously polls the Windows clipboard buffer for copied passwords or API keys and captures periodic desktop screenshots.
* Decoy Distraction: In the final installation phase, the malware opens Google Chrome maximized to a specific URL hosted on irantenders[.]com (a public database of Iranian government tenders) while running a cleanup batch script (purge.bat) to delete initial installer files.
4. Threat Profile & Artifact Matrix
Metric
Technical Detail
Execution Class
Living-off-the-Land (LotL) / Fileless PowerShell
Scheduled Tasks Registered
Local Credential Manager, Network Audio Service, Windows Display Manager
Persistence Fallback
msdiag.vbs in Startup Folder
Primary C2 Domains
corecloudfileshare[.]xyz, attachmentsharingdrive[.]xyz
Key Evasion Technique
NTFS Timestomping & Dual-Process Mutual Watchdog
Industry Impact: Evading Behavioral and Static Defenses
TASK#STOMP exemplifies the ongoing evolution of Living-off-the-Land tradecraft:
* Bypassing Signature-Based Antivirus: Because the campaign relies strictly on legitimate Windows binaries (wscript.exe, powershell.exe, schtasks.exe), traditional antivirus software inspecting executable binaries on disk detects zero malicious PE headers.
* Defeating Linear Incident Response: Standard SOC playbooks that isolate single suspicious processes fail against mutual watchdog architectures, as terminating one script immediately triggers the spawning of another.
Strategic Recommendations & Actionable Defenses
1. Disable Windows Script Host
Prevent execution of uncompiled script files (.vbs, .vbe, .js) by associating them with Notepad or disabling wscript.exe and cscript.exe via AppLocker or Software Restriction Policies.
2. Enforce PowerShell Constrained Language Mode (CLM)
Configure AppLocker or Windows Defender Application Control (WDAC) to enforce Constrained Language Mode (CLM) for standard users, preventing PowerShell scripts from compiling custom C# classes or invoking unconstrained reflection APIs.
3. Scheduled Task Auditing
Audit Windows Event ID 4698 (Scheduled Task Created) to identify newly registered tasks executing powershell.exe with hidden window flags (-WindowStyle Hidden) or encoded commands.
4. Network Perimeter Filtering
Block outbound connections to corecloudfileshare[.]xyz and attachmentsharingdrive[.]xyz. Audit DNS queries for abnormal .xyz top-level domains initiated by script interpreters.