TASK#STOMP: the Windows backdoor that steals corporate documents and Wi-Fi passwords

TASK#STOMP: the Windows backdoor that steals business documents and Wi-Fi passwords

The TASK#STOMP malware, analyzed by Securonix Threat Research, represents a serious threat to corporate networks. This Windows backdoor steals business documents, saved Wi-Fi passwords, and text from the clipboard, takes screenshots, and maintains a persistent presence in the system to continue exfiltrating data.

Quick Response

Five Points of System Entry

The infection begins with a VBScript file placed on the user's desktop. This script creates four scheduled tasks with names that mimic Windows components, such as "Network Audio Service," and copies itself to the Startup folder to ensure automatic execution upon the next login. The malware files reside in a folder named WinDefendSvc, a name reminiscent of a Windows Defender service.

Removing the script from the desktop does not remove the copy in the Startup folder. Two hidden PowerShell modules manage the data theft: one searches for documents, the other maintains a connection with the attackers' servers. Both modules are designed to restart the partner if one of them stops, although Securonix has identified a bug that leaves part of this logic unused.

Specific Targets and Time Deception Technique

The malware opens a web page in Chrome with a domain themed IranTenders, suggesting a possible targeting of organizations involved in tenders, contracts, or trade/procurement related to Iran. However, Securonix warns that a single decoy domain is not sufficient to confirm specific sectoral or regional targeting.

The malware backdates some of its files to January 15, 2024, as an anti-forensic technique, an attempt to mislead temporal analyses. Securonix emphasizes that this date is artificial and does not indicate the real start of the campaign.

Infection Vector and Recommendations

Securonix has not been able to confirm the malware delivery vector but estimates it is likely a phishing email with a ZIP, ISO, or IMG attachment containing the VBS script. Recommendations include blocking or alerting when Windows Script Host executes files from folders like Desktop, Download, or Temp, restricting Windows Script Host for standard users, and blocking ISO, IMG, and VBS attachments at the email gateway.

Attacker Profile

The malware features a relatively sophisticated design, with two modules monitoring each other and the ability to automatically switch to a backup server. However, both modules contain nearly identical code to skip security certification checks and present the same bug, indicating that the code was copied and pasted rather than developed and tested separately.

This profile—capable tools built on a base of reused or templated code, without rigorous internal review—is more typical of a mid-level operator than a mature and disciplined APT. The static and hardcoded authentication token represents a durable and high-confidence network indicator that can help link future incidents to the same operation or infrastructure.

Incident Response

Securonix experts recommend saving copies of the malware files and scheduled task definitions for analysis before taking any action. Next, it is necessary to stop the running scripts, remove all scheduled tasks created by the malware, the copy in the Startup folder, and the files staged in a single coordinated operation, and block the two command servers. After rebooting, it is essential to verify that none of the malware scripts resume execution.

To delve deeper into identity-based threat intelligence techniques, a dedicated eBook is available: Identity-First Threat Intelligence.

Implications for Cyber Insurance and Compliance

The analysis of TASK#STOMP raises important considerations for companies evaluating a cyber risk policy. The malware's ability to persist in the system and steal sensitive documents underscores the importance of an MDR service (Managed Detection and Response) for early detection of similar threats. Affected companies may face significant breach remediation costs, making adequate coverage crucial.

Furthermore, the presence of this type of malware highlights the need for NIS2 adjustment and DORA compliance for organizations operating in critical sectors. The regulations require advanced security measures and robust incident response procedures, which could help mitigate the impacts of threats like TASK#STOMP.

Proactive Protection and Risk Management

For organizations seeking to strengthen their security posture, it is essential to implement a Security Information and Event Management (SIEM) to monitor and analyze security events in real-time. Additionally, a SOC as a Service can provide continuous monitoring and managed incident response by experts.

Protection against advanced threats like TASK#STOMP also requires a structured approach to identity management and a zero trust architecture. These measures can help limit unauthorized access and reduce the attack surface available to attackers.

Final Considerations

The discovery of TASK#STOMP underscores the need for a multi-layered approach to cybersecurity. Organizations must invest in advanced incident response and managed SOC solutions to effectively address emerging threats. Additionally, compliance with regulations such as NIS2 and DORA is essential to ensure operational resilience and protection of sensitive data.