Security researchers have described a Windows backdoor tracked as TASK#STOMP that uses PowerShell to collect sensitive information from compromised computers. Reported capabilities include stealing stored Wi-Fi credentials, capturing screenshots and clipboard data, and searching for business documents that may be useful for espionage or follow-on intrusion.
Living-off-the-land tradecraft
According to Securonix research summarized by Help Net Security, the operation relies heavily on native Windows components and scripted execution. That approach can reduce the number of obvious malicious binaries placed on disk. The backdoor also uses scheduled-task behavior for persistence, giving defenders a reason to examine task creation and modification alongside PowerShell logging.
The collection profile is notable because it combines access information with operational context. Wi-Fi credentials can help an attacker understand trusted networks, while screenshots and clipboard captures may reveal session tokens, internal tools or information that users never intended to save as files. Document discovery then broadens the impact beyond the initially compromised endpoint.
Defensive implications
Organizations should monitor suspicious PowerShell ancestry, encoded or unusual command lines, new scheduled tasks and unexpected access to credential stores. Endpoint telemetry should be correlated with identity and network events rather than reviewed in isolation. This is especially important where office networks connect to cyber-physical systems, because stolen administrative credentials can create a path toward operational environments.
Leave a Reply