Reply to thread

Message: <blockquote data-quote="News Now" data-source="post: 1198452" data-attributes="member: 130193">[ATTACH=full]300143[/ATTACH]Image: <a href="https://www.helpnetsecurity.com/2026/09/21/taskstomp-windows-backdoor/" target="_blank">Help Net Security</a>A Windows backdoor called TASK#STOMP steals business documents, saved Wi-Fi passwords, clipboard text and screenshots while accepting commands from its operators. Its known reach is unclear because researchers analyzed only one infected computer.[NEWSBOX=warning]Deleting the original script is not enough. Multiple scheduled tasks and a Startup-folder copy can keep the infection active or restore it.[/NEWSBOX]<h3>What TASK#STOMP does</h3>Akshay Gaikwad and Aaron Beardslee of Securonix found that the malware searches drives for business files, uploads them to attacker-controlled servers and watches for new or edited documents. It prioritizes Word files, followed by PDFs, PowerPoint presentations, Excel spreadsheets and archives.Beardslee told <a href="https://www.helpnetsecurity.com/2026/09/21/taskstomp-windows-backdoor/" target="_blank">Help Net Security</a> that this ordering points toward corporate-document espionage rather than general-purpose cybercrime. However, Securonix has not linked the malware to a known threat group or confirmed which industries or regions are being targeted.<h3>How it remains on the PC</h3>The observed infection began with a VBScript file on the desktop. It created four scheduled tasks with Windows-like names, copied itself into the Startup folder and stored files under a folder named WinDefendSvc to resemble a Windows Defender component.Two hidden PowerShell modules manage document theft and communication with the attackers. Each attempts to restart the other if it stops, although Securonix found a coding error that makes some of this recovery logic unreachable.<h3>What Windows users and defenders should do</h3>Securonix could not confirm how the initial script reached the victim. Beardslee said a phishing message containing a ZIP, ISO or IMG attachment is the most likely route based on comparable campaigns, but that remains an estimate.<ul> <li data-xf-list-type="ul">Do not open unexpected VBS scripts or disk-image attachments, especially files delivered inside ZIP, ISO or IMG containers.</li> <li data-xf-list-type="ul">Organizations should restrict Windows Script Host for standard users or permit only signed scripts, and alert when scripts run from Desktop, Downloads or Temp folders.</li> <li data-xf-list-type="ul">If TASK#STOMP is found, preserve evidence first. Then stop its scripts and remove all related scheduled tasks, the Startup copy and staged files together before rebooting and checking that nothing restarts.</li> </ul></blockquote>

Verification

Back

Top