A sophisticated new cyber campaign, dubbed TASK#STOMP, has been uncovered, revealing a potent PowerShell backdoor meticulously designed to pilfer sensitive information from compromised systems. Cybersecurity researchers at Securonix, Akshay Gaikwad and Aaron Beardslee, detailed the backdoor’s alarming capabilities in a report shared with The Hacker News, highlighting its capacity to automatically harvest business documents, monitor file systems in real-time, steal Wi-Fi passwords and clipboard contents, capture screenshots, and execute arbitrary remote commands via two resilient, token-authenticated C2 servers.
The Covert Infection Chain
The initial breach point for TASK#STOMP begins with the execution of an encoded Visual Basic Script (VBScript) file, typically named with a random string like “95c9050t66.vbs” and staged on the victim’s desktop. While the precise method of initial access remains unconfirmed, researchers suspect common vectors such as email-based phishing or social engineering. The randomized filename is a clear tactic to bypass rudimentary file-name based detection systems, allowing the threat actor to establish a foothold discreetly.
Establishing Undetectable Persistence
The VBScript acts as the primary orchestrator, meticulously setting up multiple persistence mechanisms to ensure continuous access. It leverages Windows Scheduled Tasks, cleverly naming them “Local Credential Manager,” “Network Audio Service,” “Windows Display Manager,” and “Device Credential Handler.” These benign-sounding names are chosen to camouflage malicious activity within legitimate operating system processes, effectively evading superficial administrative scrutiny. As a failsafe, the VBScript installer also deploys a backup persistence method, utilizing the Windows Startup folder to launch another script (“msdiag.vbs”) upon every user login.
Further enhancing its stealth, the malware employs PowerShell commands to terminate any duplicate instances, ensuring only one active session. This, combined with deliberate timestamp modification (known as timestomping), hidden execution, and post-operation cleanup, underscores a concerted effort to complicate forensic analysis and bypass detection.
Dual-Module Data Exfiltration and Control
The attack progresses with the execution of two hidden PowerShell commands, each serving a distinct yet complementary role:
sys_loader.ps1: This module decodes “diag_pack.dat” to initiate a comprehensive data theft operation. It’s responsible for stealing system metadata, critical business documents, Wi-Fi credentials, and clipboard content. Furthermore, it actively monitors for newly modified files, captures screenshots, and is capable of executing arbitrary PowerShell commands on the compromised system.win_conn.ps1: Deciphering “win_conn_cfg.dat,” this script establishes a secondary, persistent Command and Control (C2) channel. This redundant channel ensures continued command execution and data collection capabilities, even if the primary channel is disrupted.
Securonix researchers emphasize the strategic advantage of running these modules as separate processes: “functional separation and operational redundancy: failure or termination of one branch does not immediately remove the other.” Both modules communicate with the same C2 infrastructure (e.g., “corecloudfileshare[.]xyz” or “attachmentsharingdrive[.]xyz”), and intriguingly, they maintain a mutual-watchdog relationship, with each component verifying the other’s running status and restarting it if necessary. This robust design guarantees maximum operational uptime for the attackers.
The Attack’s Ultimate Objective and Unanswered Questions
The overarching goal of the TASK#STOMP campaign is to establish a covert pathway for continuous data collection, including document exfiltration, credential and clipboard theft, and screenshot capture. It ensures redundant C2 communications and arbitrary code execution, all while employing an array of sophisticated techniques to remain undetected.
In a puzzling final stage, the VBScript orchestrator opens Google Chrome in a maximized window, directing it to a specific URL on “irantenders[.]com.” This website hosts a searchable database of government tenders and contracts in Iran. The motivation behind this user-facing web action remains unknown, adding a layer of mystery to the campaign’s full scope.
Finally, a batch script (“purge.bat”) is launched, initiating a two-second delay, likely intended for a cleanup operation to erase traces of the malicious activity. However, the exact contents and actions of this script have not yet been recovered, leaving its full impact unclear.
Leveraging Native Windows Components for Evasion
As the researchers conclude, “Threat actors routinely abuse Windows Script Host, PowerShell, Task Scheduler, and the .NET toolchain to blend malicious execution with legitimate administrative activity.” TASK#STOMP exemplifies this strategy, utilizing a VBS-controlled framework to deploy multiple persistence anchors and delegate subsequent malicious functions to PowerShell and dynamically compiled C# code. By predominantly relying on native Windows components, the operation significantly reduces its dependency on conventional executable payloads, making individual malicious events exceedingly difficult to distinguish from benign system activity.
Stay informed on the latest cybersecurity threats. Follow us on Google News, Twitter, and LinkedIn for exclusive content and updates.
For more details, visit our website.
Source: Link
Leave a comment