A newly documented backdoor called TASK#STOMP leans almost entirely on tools that ship with Windows, making its activity harder to separate from routine administration.
Securonix researchers Akshay Gaikwad and Aaron Beardslee described the campaign. The entry point is a randomly named VBScript, 95c9050t66.vbs, sitting on the victim’s desktop and launched through wscript.exe. How it lands there is unclear; phishing or social engineering is likely.
Persistence dressed as system services
Persistence arrives as scheduled tasks the script creates. Their names – Local Credential Manager, Network Audio Service, Windows Display Manager, Device Credential Handler – are chosen to pass as ordinary operating system jobs. A second anchor, msdiag.vbs, lands in the Startup folder so it fires at every login, and the code rewrites file timestamps to slow forensic review.
Two hidden PowerShell modules follow. sys_loader.ps1 decodes diag_pack.dat, harvesting business documents, Wi-Fi passwords and clipboard contents, watching the filesystem for newly changed files, and capturing screenshots. win_conn.ps1 decodes win_conn_cfg.dat and opens a second channel with remote command execution. Each module watches the other and restarts it if it stops, so killing one leaves the other running.
One step nobody can explain
Both talk to the same infrastructure at corecloudfileshare[.]xyz or attachmentsharingdrive[.]xyz.
The final stage is stranger. The orchestrator opens Chrome in a maximized window and navigates to a page on irantenders[.]com, a searchable database of tenders and contracts issued by Iranian government departments. The researchers do not know why. A batch script named purge.bat also runs after a two-second delay, presumably to clean up, but its contents were never recovered.
