> ## Content Index > Fetch the complete content index at: https://f4n6.co.uk/llms.txt > Use this file to discover other available public pages before exploring further. # TASK#STOMP PowerShell Backdoor Steals Documents, Wi-Fi Passwords, and Clipboard Data - URL: https://f4n6.co.uk/security-feed/task-stomp-powershell-backdoor-steals-documents-wi-fi-passwords-and-clipboard-data/ - Published: 2026-09-21T21:38:21.000Z - Updated: 2026-09-21T21:38:21.000Z - Author: Jeff Davies - Tags: #security-feed ## 1\. Executive summary Securonix Threat Research (researchers Akshay Gaikwad and Aaron Beardslee) has disclosed TASK#STOMP, a campaign delivering a PowerShell backdoor for Windows hosts that harvests business documents, monitors the filesystem for new and modified files in real time, steals saved Wi-Fi passwords and clipboard contents, takes screenshots, and accepts arbitrary remote commands through two redundant, token-authenticated C2 servers. Persistence is layered across scheduled tasks with benign-sounding names and a Startup-folder script, with a mutual-watchdog design that restarts either component if the other dies. The initial access pathway is unclear; the researchers suspect email phishing or social engineering. The analysis is built from a single infected machine, so campaign scope, victimology, and attribution are all unconfirmed. For EMEA financial services the bottom-line risk is sustained, quiet exfiltration of business documents and credentials from endpoints, which is a data-breach scenario rather than a disruptive one. ## 2\. Regulatory framing No specific DORA/NIS2 article is directly engaged by this item. The campaign is a generic endpoint-compromise scenario with no confirmed initial access vector, no confirmed victim organisations, and no third-party or concentration angle in the source material; a mapping here would fit virtually any malware report. ## 3\. Technical analysis & attack chain Confirmed steps, per the Securonix analysis as reported by The Hacker News and Help Net Security: 1. Initial access. The infection chain starts with `wscript.exe` executing an encoded Visual Basic Script file staged on the victim's desktop, named `95c9050t66.vbs`. The exact delivery pathway is unclear; phishing or social engineering is suspected but unconfirmed. The random filename is assessed as an attempt to evade filename-based detection. 2. Persistence via scheduled tasks. The VBScript acts as an orchestrator, establishing persistence through scheduled tasks named Local Credential Manager, Network Audio Service, Windows Display Manager, and Device Credential Handler, chosen to blend with normal operating system activity. 3. Backup persistence. The installer also drops a second script, `msdiag.vbs`, into the Windows Startup folder so it runs at every user logon. 4. Session enforcement. PowerShell commands forcibly terminate previously running instances so only one active session exists. 5. Module execution. Two hidden PowerShell commands run: - `sys_loader.ps1` decodes `diag_pack.dat` and initiates document theft, surveillance, and remote access. This payload steals system metadata, business documents, Wi-Fi passwords, and clipboard content, monitors for newly modified files, takes screenshots, and executes arbitrary PowerShell commands. - `win_conn.ps1` decodes `win_conn_cfg.dat` and sets up a secondary, persistent C2 channel with command execution and collection capabilities. 6. C2\. Both modules communicate with the same infrastructure: `corecloudfileshare[.]xyz` or `attachmentsharingdrive[.]xyz`. The channels are token-authenticated. 7. Watchdog. The two components monitor each other: `diag_pack.dat` checks whether `win_conn.ps1` is running and restarts it if not, and vice versa. Running the modules as separate processes gives functional separation and operational redundancy, so killing one branch does not remove the other. 8. Anti-forensics. The chain uses timestomping (deliberate timestamp modification), hidden execution, and cleanup behaviour to defeat superficial administrative review and complicate forensic analysis. 9. Final stage. The VBScript orchestrator opens Google Chrome maximised and navigates to a URL on `irantenders[.]com`, a searchable database of tenders and contracts issued by Iranian government departments and local authorities. The purpose of this user-facing action is unknown. A batch script, `purge.bat`, is also launched with a two-second delay and likely erases traces of the activity; its contents have not been recovered, so what it does is unknown. Capability summary for defenders: drive-wide search for business documents with upload to attacker servers, real-time filesystem watching for new or edited files, saved Wi-Fi password theft, clipboard text capture, screenshot capture, and arbitrary PowerShell command execution. No privilege escalation, lateral movement, or defence-evasion technique beyond those listed is described in the source material. Confidence caveat: the entire technical picture, including the IOC set, rests on a single vendor report built from one infected machine. Securonix cannot say how many organisations are affected, and no attribution claim appears in the material. Treat the indicators as single-sourced; verify before enforcement. ## 4\. Mitigation & containment P1, within 24 hours: - Hunt for the artefacts across the estate: the desktop file `95c9050t66.vbs`, the Startup-folder script `msdiag.vbs`, the PowerShell scripts `sys_loader.ps1` and `win_conn.ps1`, the data files `diag_pack.dat` and `win_conn_cfg.dat`, and the batch file `purge.bat`. Any hit means a likely compromised host: isolate it and image it before cleanup, because timestomping and the purge script will degrade forensic evidence. - Block DNS resolution and outbound traffic to `corecloudfileshare[.]xyz` and `attachmentsharingdrive[.]xyz` at the proxy, DNS sinkhole, and firewall. Both C2 channels use these domains, so blocking them cuts command execution even if the process survives. - Search scheduled-task inventories for the four task names: Local Credential Manager, Network Audio Service, Windows Display Manager, Device Credential Handler. None of these is a legitimate Windows task name; any match is high-signal. P2, within 72 hours: - Review proxy and DNS logs for the two C2 domains and for `irantenders[.]com` in combination with a maximised Chrome session, to establish whether any hosts have already beaconed. Look back at least 30 days. - Constrain script execution: enforce AppLocker or WDAC policies blocking `wscript.exe` from executing VBScript in user-writable locations such as the Desktop and Startup folder, and apply PowerShell Constrained Language Mode or script-block logging. The entire chain depends on VBScript and PowerShell, so both controls directly break it. - Check whether saved Wi-Fi profiles on any implicated hosts were exported (the malware steals stored Wi-Fi passwords); rotate those credentials and treat the wireless networks as exposed. P3, within 7 days: - Review egress rules so endpoints cannot reach newly registered domains in bulk; both C2 domains follow a file-sharing naming pattern that a domain-age or reputation check would flag. - Because documents are the target, conduct a targeted review of what business documents existed on any confirmed-compromised host and assess notification obligations if client data was in scope. - No vendor fix applies; this is a malware campaign, not a product vulnerability. There is no patch to apply. ## 5\. Indicators of compromise | type | value | confidence | source | | -------------- | ------------------------------ | ---------- | ------------------------------------------------------------------------------------------------------------ | | filename | 95c9050t66.vbs | high | Securonix via The Hacker News | | filename | msdiag.vbs | high | Securonix via The Hacker News | | filename | sys\_loader.ps1 | high | Securonix via The Hacker News | | filename | win\_conn.ps1 | high | Securonix via The Hacker News | | filename | diag\_pack.dat | high | Securonix via The Hacker News | | filename | win\_conn\_cfg.dat | high | Securonix via The Hacker News | | filename | purge.bat | high | Securonix via The Hacker News | | domain | corecloudfileshare\[.\]xyz | high | Securonix via The Hacker News | | domain | attachmentsharingdrive\[.\]xyz | high | Securonix via The Hacker News | | domain | irantenders\[.\]com | low | Securonix via The Hacker News; purpose of the visit unknown, the site itself is a legitimate tender database | | scheduled-task | Local Credential Manager | high | Securonix via The Hacker News | | scheduled-task | Network Audio Service | high | Securonix via The Hacker News | | scheduled-task | Windows Display Manager | high | Securonix via The Hacker News | | scheduled-task | Device Credential Handler | high | Securonix via The Hacker News | All indicators are single-sourced, from one vendor report on one infected machine. Verify before enforcement. ```iocs filename 95c9050t66.vbs filename msdiag.vbs filename sys_loader.ps1 filename win_conn.ps1 filename diag_pack.dat filename win_conn_cfg.dat filename purge.bat domain corecloudfileshare[.]xyz domain attachmentsharingdrive[.]xyz domain irantenders[.]com scheduled-task Local Credential Manager scheduled-task Network Audio Service scheduled-task Windows Display Manager scheduled-task Device Credential Handler ``` ## 6\. Detection ```yara rule TASKSTOMP_PowerShell_Backdoor_Artefacts { meta: author = "Adverse Trace" date = "2026-09-21" reference = "https://thehackernews.com/2026/09/taskstomp-powershell-backdoor-steals.html" description = "Detects TASK#STOMP VBScript and PowerShell components by script and data filenames referenced in the Securonix analysis" strings: $vbs1 = "95c9050t66.vbs" ascii $vbs2 = "msdiag.vbs" ascii $ps1 = "sys_loader.ps1" ascii $ps2 = "win_conn.ps1" ascii $dat1 = "diag_pack.dat" ascii $dat2 = "win_conn_cfg.dat" ascii $bat = "purge.bat" ascii $c2a = "corecloudfileshare" ascii $c2b = "attachmentsharingdrive" ascii condition: 3 of them } ``` ```yaml title: TASKSTOMP Scheduled Task Persistence with Masquerading Names id: 7c1f2a44-8b3e-4d19-9f6a-2e5d8c0b1a77 status: experimental description: Detects creation of scheduled tasks using the TASK#STOMP persistence names reported by Securonix references: - https://thehackernews.com/2026/09/taskstomp-powershell-backdoor-steals.html - https://www.helpnetsecurity.com/2026/09/21/taskstomp-windows-backdoor/ author: Adverse Trace date: 2026/09/21 logsource: product: windows category: process_creation detection: selection_task_names: CommandLine|contains: - 'Local Credential Manager' - 'Network Audio Service' - 'Windows Display Manager' - 'Device Credential Handler' condition: selection_task_names falsepositives: - Legitimate software creating identically named tasks; none of these are default Windows task names, so treat any hit as high-signal level: high ``` ## 7\. Sources - The Hacker News, TASK#STOMP PowerShell Backdoor Steals Documents, Wi-Fi Passwords, and Clipboard Data, https://thehackernews.com/2026/09/taskstomp-powershell-backdoor-steals.html, 2026-09-21 - Help Net Security, The TASK#STOMP Windows backdoor takes Wi-Fi passwords, screenshots, and business files, https://www.helpnetsecurity.com/2026/09/21/taskstomp-windows-backdoor/, 2026-09-21 ## 8\. Adverse Trace position We assess TASK#STOMP as a moderate-severity espionage-style threat to EMEA financial services endpoints: the capability set (document harvesting, clipboard and Wi-Fi credential theft, screenshots, arbitrary command execution, redundant persistence) is well suited to quiet data collection, but the analysis rests on one infected machine from one vendor, campaign scope is unknown, and no attribution claim exists, so we treat attribution as unconfirmed. No CISA-KEV or CVSS data applies, as this is a malware campaign rather than a product vulnerability. The immediate client action is the P1 hunt for the named files, scheduled tasks, and C2 domains; the domains and task names are distinctive enough that a clean sweep is meaningful evidence of non-exposure. We will track Securonix for the full report and any follow-on victimology data, and we will update this advisory if the initial access vector, the purge.bat contents, or attribution is confirmed. --- [Read the original source →](https://thehackernews.com/2026/09/taskstomp-powershell-backdoor-steals.html?ref=f4n6.co.uk) *Published via PulseTrace — Adverse Trace threat intelligence.*