TASK#STOMP Windows Backdoor Steals Business Files, Wi-Fi Passwords, and Screenshots
Summary
Securonix analyzed TASK#STOMP on one infected machine. The Windows backdoor steals business documents, Wi-Fi passwords, clipboard text, and screenshots, and persists through scheduled tasks and a Startup-folder copy. Its delivery vector and attribution remain unverified
Key points
- TASK#STOMP searches drives for business documents, uploads them, and continues collecting new or modified files.
- It also steals saved Wi-Fi passwords and clipboard text, captures screenshots, and can run operator commands.
- The malware creates four scheduled tasks and a Startup-folder copy; removing only one foothold may leave others able to restore the infection.
- Securonix’s analysis was based on one infected machine, so the number of affected organizations and campaign start date are unknown.
- Researchers found no clear link to a known APT. The apparent January 15, 2024 file dates were fabricated and are not evidence of when the campaign began.
- Phishing with a ZIP or ISO/IMG attachment is Securonix’s best estimate for delivery, not a confirmed infection vector.
- Securonix recommends hunting for the malware’s token, hashes, command-server domains, and scheduled tasks, then removing all footholds together.
Article Details
- Attack Vectors
- Likely delivery via a phishing email containing a ZIP or ISO/IMG attachment with a VBScript; researchers could not confirm the delivery vector from the recovered evidence.
- The VBScript creates four scheduled tasks and copies itself into the Startup folder for persistence.
- PowerShell modules search for business documents, collect saved Wi-Fi passwords, clipboard text and screenshots, and run operator-supplied commands.
- The malware exfiltrates documents to attacker servers and maintains an additional channel to its operators.
- Defensive Notes
- Alert on or block Windows Script Host execution of files from Desktop, Downloads, or Temp; restrict Windows Script Host for standard users or allow only signed scripts.
- Strip, sandbox, or block ISO, IMG, and VBS attachments at the mail gateway.
- Use the advisory's command-server domains, authentication token, and file hashes to search network and endpoint telemetry; inspect proxy logs for the token where encrypted traffic inspection is available.
- Preserve malware files and scheduled-task definitions for analysis, then remove all created tasks, the Startup copy, and staged files in one coordinated pass; block both command servers and verify after reboot that scripts do not restart.
- Do not treat the IranTenders-themed decoy site as malicious or block its entire domain based on this report alone.
MITRE ATT&CK
T1005 · Data from Local SystemA module searches victim drives for business documents, including new or modified files.T1041 · Exfiltration Over C2 ChannelThe malware uploads collected business documents to attacker servers.T1053.005 · Scheduled TaskTASK#STOMP creates four Windows scheduled tasks with names imitating Windows components to persist.T1059 · Command and Scripting InterpreterThe malware runs commands sent by its operators.T1059.001 · PowerShellHidden PowerShell modules perform document theft and maintain a channel to the operators.T1059.005 · Visual BasicThe infection begins with a VBScript file executed through Windows Script Host.T1070.006 · TimestompTASK#STOMP backdates several files to January 15, 2024; researchers describe this as an anti-forensic tactic, not a reliable campaign start date.T1113 · Screen CaptureThe malware takes screenshots.T1115 · Clipboard DataThe malware collects clipboard text.T1547.001 · Registry Run Keys / Startup FolderThe malware copies its VBScript into the Startup folder so it runs when the user signs in.T1555.004 · Windows Credential ManagerTASK#STOMP collects saved Wi-Fi passwords.