Image: Help Net Security
A Windows backdoor called TASK#STOMP steals business documents, saved Wi-Fi passwords, clipboard text and screenshots while accepting commands from its operators. Its known reach is unclear because researchers analyzed only one infected computer.
What TASK#STOMP does
Akshay Gaikwad and Aaron Beardslee of Securonix found that the malware searches drives for business files, uploads them to attacker-controlled servers and watches for new or edited documents. It prioritizes Word files, followed by PDFs, PowerPoint presentations, Excel spreadsheets and archives.Beardslee told Help Net Security that this ordering points toward corporate-document espionage rather than general-purpose cybercrime. However, Securonix has not linked the malware to a known threat group or confirmed which industries or regions are being targeted.
How it remains on the PC
The observed infection began with a VBScript file on the desktop. It created four scheduled tasks with Windows-like names, copied itself into the Startup folder and stored files under a folder named WinDefendSvc to resemble a Windows Defender component.Two hidden PowerShell modules manage document theft and communication with the attackers. Each attempts to restart the other if it stops, although Securonix found a coding error that makes some of this recovery logic unreachable.
What Windows users and defenders should do
Securonix could not confirm how the initial script reached the victim. Beardslee said a phishing message containing a ZIP, ISO or IMG attachment is the most likely route based on comparable campaigns, but that remains an estimate.- Do not open unexpected VBS scripts or disk-image attachments, especially files delivered inside ZIP, ISO or IMG containers.
- Organizations should restrict Windows Script Host for standard users or permit only signed scripts, and alert when scripts run from Desktop, Downloads or Temp folders.
- If TASK#STOMP is found, preserve evidence first. Then stop its scripts and remove all related scheduled tasks, the Startup copy and staged files together before rebooting and checking that nothing restarts.
