Cybersecurity experts have unveiled details of a sophisticated cyber attack known as TASK#STOMP, which utilizes a PowerShell backdoor to extract sensitive data from infected systems. This new threat, identified by Securonix researchers Akshay Gaikwad and Aaron Beardslee, poses significant risks by targeting business documents, Wi-Fi credentials, clipboard data, and more.
How TASK#STOMP Infiltrates Systems
The initial entry point for TASK#STOMP is through the execution of an encoded VBScript file, ’95c9050t66.vbs’, on the victim’s desktop via ‘wscript.exe’. Although the exact method of delivery is unclear, phishing or social engineering are suspected. The script establishes persistence and initiates further stages of the attack, masquerading as legitimate system processes to avoid detection.
Persistence is maintained through several methods, including scheduled tasks named to mimic regular system activities. Additionally, a backup persistence mechanism is implemented using the Windows Startup folder, ensuring the backdoor reloads upon user login.
Technical Mechanisms and Evasion Strategies
Once installed, TASK#STOMP executes PowerShell commands to eliminate any competing processes and ensures a single active session. The malware employs techniques such as timestamp modification and stealthy execution to evade forensic scrutiny, using multiple persistence strategies to ensure continued operation even if partially neutralized.
The attack deploys two PowerShell scripts: ‘sys_loader.ps1’ and ‘win_conn.ps1’. The former decodes and executes document-theft payloads, while the latter establishes a persistent command and control (C2) connection. These scripts support redundant operations, with each monitoring the other to maintain ongoing functionality.
Impact and Future Implications
The ultimate aim of TASK#STOMP is to enable persistent data theft, including document exfiltration and credential capture, while maintaining a low profile. The attack concludes with a user-facing action, opening Google Chrome to a specific Iranian tender database, although the intent remains unclear.
The operation exemplifies how threat actors exploit native Windows tools like PowerShell and Task Scheduler to integrate malicious activities within legitimate administrative processes. By avoiding traditional executable payloads, TASK#STOMP complicates detection and analysis, posing a significant challenge for cybersecurity defenses.
As the cybersecurity landscape evolves, understanding and mitigating such advanced threats remain a priority for protecting sensitive information from unauthorized access.
