Inside TASK#STOMP: The PowerShell Backdoor With 5 Self-Healing Footholds Built for Corporate Document Espionage
Author: DigitalSpying Security Desk
Date: September 21, 2026
Category: Malware Analysis / Endpoint Security / Cyber Espionage
Executive Summary
A newly uncovered, highly targeted cyber espionage campaign dubbed TASK#STOMP has been identified delivering a sophisticated PowerShell backdoor engineered to conduct granular intellectual property and business document theft. Disclosed in a detailed technical threat report by Securonix Threat Research and covered by The Hacker News, the malware demonstrates remarkable persistence, redundancy, and real-time surveillance capabilities.
Unlike opportunistic commodity stealers that focus primarily on browser passwords and cryptocurrency wallets, TASK#STOMP is purpose-built for corporate espionage. The backdoor methodically scans attached storage drives, prioritizing high-value commercial files—specifically Word documents (.docx), PDFs, PowerPoint presentations (.pptx), and Excel spreadsheets (.xlsx)—ahead of compressed archives. Furthermore, it installs an active real-time filesystem watcher to intercept and exfiltrate documents the moment users edit or save them. To guarantee survival on compromised endpoints, TASK#STOMP establishes at least five independent persistence footholds across the Windows Scheduled Task subsystem and the Startup folder. If an incident responder or antivirus tool terminates one component without eradicating the others, the remaining tasks automatically regenerate the full infection chain.
Deep-Dive Technical Analysis
1. Initial Ingestion and Multi-Stage Execution Chain
The infection chain initiates with living-off-the-land binaries (LotL) commonly present on Windows enterprise workstations:
* The VBScript Stager: The intrusion begins when Windows Script Host (wscript.exe) executes an encoded Visual Basic Script staged on the victim’s desktop or user directory (e.g., 95c9050t66.vbs).
* Decoy Browser Invocation: To distract the user and provide plausible context, the script automatically launches Google Chrome, navigating to a decoy commercial procurement portal (such as an "IranTenders" trade domain). This lure design strongly indicates that the threat actors target organizations involved in international bidding, trade contracts, or cross-border logistics.
* PowerShell Deobfuscation: Simultaneously in the background, the VBScript spawns an obfuscated PowerShell execution string using hidden window parameters (-WindowStyle Hidden -ExecutionPolicy Bypass). The script unpacks in-memory arrays, decrypts secondary payloads, and establishes the core backdoor loop.
+----------------------------------------------------------------------------------------------------+
| TASK#STOMP MULTI-STAGE ATTACK CHAIN |
|---|
[Target User / Victim Desktop]
|
| 1. wscript.exe executes encoded stager (95c9050t66.vbs)
+---> Launches Google Chrome to Decoy Trade/Procurement Portal (Distraction)
|
| 2. Spawns hidden PowerShell process: powershell.exe -ExecutionPolicy Bypass
v
[Self-Healing Persistence Engine Established (5 Footholds)]
|
+---> Scheduled Task 1: Document Harvester (Runs every 15 mins)
+---> Scheduled Task 2: Real-time Filesystem Watcher (Background Monitor)
+---> Scheduled Task 3: C2 Beacon & Command Listener (Dual Token Auth)
+---> Scheduled Task 4: Watchdog / Integrity Verifier (Rebuilds deleted tasks)
+---> Windows Startup Folder: Fallback launcher script (.vbs in %APPDATA%\Startup)
v
[Targeted Corporate Surveillance & Data Harvesting]
|
+---> Document Harvester: Prioritizes Word (.docx) -> PDF -> PowerPoint -> Excel
+---> Real-time FileSystemWatcher: Instantly steals newly created/edited files
+---> Wi-Fi Credential Extraction: netsh wlan show profile key=clear
+---> System Reconnaissance: Clipboard scraping & automated desktop screenshots
v
[Dual Token-Authenticated C2 Infrastructure]
|
| 3. Exfiltrates stolen assets & receives remote commands via HTTPS POST
+---> Primary C2 Node (Encrypted TLS + Bearer Auth Token)
+---> Secondary Fallback C2 Node (Automatic failover)
2. The Five-Point Self-Healing Persistence Matrix
A standout technical trait of TASK#STOMP is its resilient, multi-point persistence mechanism designed to defeat standard incident response cleanups:
* Four Dedicated Scheduled Tasks: The malware creates four distinct scheduled tasks within the Windows Task Scheduler (schtasks.exe):
1. The Execution Engine Task: Ensures the primary PowerShell backdoor runtime is kept active.
2. The Surveillance Monitor Task: Keeps the document harvesting and filesystem monitoring loops alive.
3. The C2 Communication Task: Manages outbound polling and command execution.
4. The Watchdog / Guardian Task: Periodically queries the Windows Task Scheduler. If it detects that any of the other tasks have been deleted or modified, it immediately re-registers them from an encrypted local template.
* The Startup Folder Fallback: It writes an identical VBScript launcher into the current user's Startup folder (%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup).
* The Self-Healing Loop: If an administrator identifies and deletes two or three of the scheduled tasks, the watchdog task or the Startup script detects the missing components upon next reboot or scheduled interval and fully restores the entire five-element persistence framework.
3. Targeted Data Exfiltration: The Document Priority Engine
Rather than indiscriminately sweeping all files—which generates substantial disk I/O and network telemetry that triggers Endpoint Detection and Response (EDR) rate-limiting alerts—TASK#STOMP executes a calculated, low-noise collection strategy:
* Document Hierarchy: The malware iterates through attached logical drives (C:\, D:\, network shares), checking file extensions in a strict hierarchy:
1. Microsoft Word (.docx, .doc)
2. Portable Document Format (.pdf)
3. PowerPoint Presentations (.pptx, .ppt)
4. Excel Workbooks (.xlsx, .xls)
* Real-Time Filesystem Interception: Crucially, the backdoor initializes a .NET System.IO.FileSystemWatcher object. This event-driven monitor hooks file system notifications across user directories (Desktop, Documents, Downloads). When an employee creates a new confidential document or modifies an existing draft, the event triggers an immediate, silent background upload to the attacker's server.
* Wi-Fi & Environment Scraping: The script executes native shell queries to extract sensitive credentials:
Wi-Fi Profile and Plaintext Key Extraction
netsh wlan show profile | Select-String "\:(.+)$" | ForEach-Object {
$name = $_.Matches.Groups[1].Value.Trim()
netsh wlan show profile name="$name" key=clear
}
It extracts cleartext Wi-Fi passwords, enumerates internal network adapters, logs active clipboard text, and periodically captures full-screen PNG screenshots.
4. Redundant, Token-Authenticated C2 Protocol
To secure its operational communications, TASK#STOMP connects to two redundant command-and-control servers using custom HTTPS POST requests. Each outbound request carries a hardcoded, static authentication token embedded within the HTTP headers. The C2 servers drop or return generic HTTP 404 responses to any inbound connection that lacks this exact token, preventing security researchers, sandboxes, and automated internet scanners from interrogating the C2 endpoints.
Industry Impact & Corporate Threat Landscape
The design of TASK#STOMP signals a calculated return to stealthy, specialized corporate espionage:
1. Targeting Commercial Procurement & Trade: The use of trade- and procurement-themed decoy domains demonstrates that the operators seek sensitive competitive bidding documents, government contracts, intellectual property, and pricing models.
2. The Inefficacy of Partial Remediations: Standard antivirus utilities that detect and quarantine a single VBScript or scheduled task will fail to remediate a TASK#STOMP infection. The surviving tasks will quietly rebuild the backdoor, allowing threat actors to maintain persistent access undetected for months.
3. Living-off-the-Land Weaponization: Because the entire malware relies on native Windows interpreters (wscript.exe, powershell.exe) and standard administrative utilities (schtasks.exe, netsh.exe), it frequently bypasses legacy signature-based antivirus solutions.
Recommendations & Mitigation Strategies
Security operations centers (SOCs) and systems administrators must deploy defense-in-depth measures to detect and neutralize TASK#STOMP.
1. Disable Windows Script Host & Enforce Script Policies
* Disable WScript/CScript for Standard Users: Block the execution of standalone .vbs and .js files via Group Policy (GPO) by navigating to HKLM\Software\Microsoft\Windows Script Host\Settings and setting Enabled to 0.
* Enforce PowerShell Constrained Language Mode: Configure PowerShell to operate in Constrained Language Mode across all non-administrative workstations, which blocks the invocation of arbitrary .NET objects (such as FileSystemWatcher and raw memory reflection).
2. Comprehensive Remediation Protocols
If a TASK#STOMP infection is suspected, incident responders must eradicate all persistence footholds simultaneously:# Incident Response Checklist: Terminate processes and clean scheduled tasks
Get-Process -Name powershell, wscript | Where-Object { $_.CommandLine -like "*95c9050*" } | Stop-Process -Force
Audit and remove all newly registered scheduled tasks
Get-ScheduledTask | Where-Object { $_.Actions.Execute -like "*powershell*" -or $_.Actions.Execute -like "*wscript*" }
Clean user Startup folder
Get-ChildItem -Path "$env:APPDATA\Microsoft\Windows\Start Menu\Programs\Startup" -Filter "*.vbs" | Remove-Item -Force
3. Threat Hunting & EDR Detection Queries
* Monitor Process Lineage: Configure EDR to flag wscript.exe spawning powershell.exe with hidden window flags (-WindowStyle Hidden) or execution policy bypass parameters.
* Detect Wi-Fi Key Extraction: Create behavioral rules alerting on command-line invocations of netsh wlan show profile * key=clear.
* Network Egress Auditing: Monitor web proxies and firewall logs for recurring outbound HTTPS connections containing non-standard authorization headers or communicating with newly registered external domains.