Reported by 3 outlets
TASK#STOMP PowerShell Backdoor Steals Business Documents and Executes Remote Commands
Why this score
- Breadth
- 1.50 / 2.0 · 3 sources
- Authority
- 1.20 / 2.0 · best outlet weight
- Severity
- 0.50 / 5.0 · CVSS + content signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.10 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Analysis
TASK#STOMP is a PowerShell backdoor that establishes persistent remote access on Windows hosts using scheduled tasks, VBScript, and in-memory payload execution. The malware stages files in a folder named WinDefendSvc, launches hidden PowerShell scripts (sysloader.ps1 and winconn.ps1) from msdiag.vbs placed in the Startup folder, and reads Base64-encoded DAT payloads (diagpack.dat and winconncfg.dat) for document surveillance and remote command execution. It also captures screenshots, steals saved Wi-Fi passwords and clipboard text, changes file timestamps to 2024-01-15 to blend in, and uses dual command servers for resilience. The initial delivery vector remains unknown.
This is a targeted espionage tool rather than a commodity ransomware dropper. The use of Windows Script Host, scheduled tasks, and in-memory PowerShell makes it hard to detect without behavioral monitoring. Organizations should hunt for scheduled tasks named OneDriveUpdateScheduler or similar, startup folder entries like msdiag.vbs, and the WinDefendSvc staging directory. Watch for updates on attribution and any indicators of compromise linked to campaigns targeting specific geographic or sector profiles.
Timeline
-
original reporting
TASK#STOMP PowerShell Backdoor Steals Business Documents and Executes Remote Commands
gbhackers.com · 21d ago · September 22nd, 2026
A Windows-focused backdoor dubbed TASK#STOMP that uses VBScript, PowerShell, Scheduled Tasks, and runtime C# compilation to establish resilient persistence and continuously steal business documents. The implant also captures screenshots, extracts saved Wi-Fi passwords, harvests clipboard data, and executes arbitrary commands received from its operators. While the original delivery method is unconfirmed, the location is consistent […] The post TASK#STOMP PowerShell Backdoor Steals Business Documents and Executes Remote Commands appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .
-
update from securityonline.info
Learn how the new TASK#STOMP PowerShell backdoor steals data. The TASK#STOMP PowerShell backdoor abuses native Windows tools for persistence
securityonline.info · 19d ago · September 24th, 2026
The TASK#STOMP PowerShell backdoor abuses native Windows tools for persistence
via Mastodon https://securityonline.info/taskstomp-powershell-backdoor/?utm_source=mastodon&utm_medium=jetpack_social
-
update from cyberpress.org
TASK#STOMP PowerShell Backdoor Steals Business Documents and Maintains Persistent Remote Access
cyberpress.org · 19d ago · September 24th, 2026
Its decoded payloads search local drives, watch for new files, and send collected data to two command-and-control servers. The malware can also capture screenshots, steal saved Wi-Fi passwords and clipboard text, and execute commands from an operator. The observed chain begins when Windows Script Host runs a VBScript file from a user’s desktop. Researchers have not established how the file arrived, so its initial delivery method remains unknown. The script creates four scheduled tasks from XML files under LOCALAPPDATA and places msdiag.vbs in the user’s Startup folder. Together, these mechanisms can relaunch the malware after sign-in or a restart. TASK#STOMP Backdoor Steals Documents The installer stages files in a folder named WinDefendSvc , a name that resembles a Windows security component. It launches two hidden PowerShell scripts, sysloader.ps1 and winconn.ps1 , after terminating older instances. It also changes the modification times of five staged files to January 15, 2024, making them appear older than the observed activity. Each script reads a Base64-encoded DAT file, decodes its PowerShell payload, and executes it in memory. The primary payload, diagpack.dat , handles document collection and surveillance. Encoded VBS Script (Source: securonix) The secondary payload, winconncfg.dat , maintains a separate remote-access channel. The modules can restart one another, although researchers found a coding flaw that prevents one additional watchdog check from normally runnin