TASK#STOMP Windows Backdoor Harvests Wi‑Fi Passwords, Screenshots, and Business Documents
What Happened – Researchers at Securonix dissected a new Windows backdoor, TASK#STOMP, that installs multiple persistence mechanisms (scheduled tasks, Startup folder copy) and exfiltrates saved Wi‑Fi credentials, clipboard data, screenshots, and newly‑created or edited business files. The malware is delivered via a VBScript placed on the user’s desktop and uses hidden PowerShell modules to maintain command‑and‑control channels.
Why It Matters for Trust & Control Assurance
- The multi‑layered persistence (five footholds) illustrates why continuous endpoint monitoring and evidence collection are essential to prove that malicious artifacts have been fully eradicated.
- Theft of Wi‑Fi passwords and document exfiltration highlights gaps in credential‑management policies and the need for auditable access‑control controls.
- The ability of the backdoor to re‑create itself after partial removal underscores the importance of a documented incident‑response playbook that includes verification of complete remediation.
Who Is Affected – Enterprises that run Windows workstations, especially those handling sensitive corporate documents, procurement data, or internal network credentials.
Recommended Actions
- Map the persistence and credential‑theft behaviors to your endpoint‑security and identity‑access controls; collect logs from scheduled‑task creation, Startup folder changes, and PowerShell module execution as audit evidence.
- Validate that Wi‑Fi credential storage follows least‑privilege and encryption policies; rotate any exposed passwords.
- Run a full remediation checklist that verifies removal of all scheduled tasks, Startup copies, and hidden PowerShell modules, then document the steps for audit readiness.
Technical Notes – The infection chain starts with a desktop‑placed VBScript that spawns four scheduled tasks mimicking Windows services and copies the payload to a folder named WinDefendSvc. Two PowerShell modules perform document harvesting and maintain a secondary C2 channel. No CVE is associated; the threat relies on native Windows scripting and scheduling features. Source: https://www.helpnetsecurity.com/2026/09/21/taskstomp-windows-backdoor/