TASK#STOMP: The Windows Backdoor With Five Persistence Mechanisms

On September 21, 2026, the Securonix threat research team published a technical analysis of TASK#STOMP, a Windows backdoor active on at least one endpoint from which researchers examined a sample. The malware steals saved Wi-Fi passwords, screenshots, clipboard text, and corporate documents, using exclusively native Windows components to blend in. The structure reveals an operator with concrete technical capabilities but signs of haste or lack of internal review: the same copy-paste bug appears in both PowerShell modules, and a hardcoded authentication token provides analysts with a high-fidelity network indicator for clustering future incidents.

How the VBS-Orchestrated Framework Works

Execution begins from a VBScript found on the user's desktop, file 95c9050t66.vbs launched via wscript.exe. This first stage orchestrates the loading of the main PowerShell modules, delegating collection and exfiltration operations to a framework that employs no third-party components: every element is native Windows, a choice that reduces the detection surface for tools focused on anomalous software signatures.

The two modules operate in parallel with a watchdog relationship. sys_loader.ps1 handles document theft and surveillance activities; win_conn.ps1 maintains the channel to the C2 servers. Each monitors the other: if one process terminates, its companion restarts it. The functional separation provides operational redundancy, but Securonix notes that both modules share the same copy-paste error in the code, a detail that accelerated forensic analysis.

The malware also opens the Chrome browser to the page irantenders[.]com. Securonix hypothesizes its use as a decoy or thematic lure tied to procurement, without classifying the site as malicious. The mechanism likely serves to mask real activity behind plausible user behavior.

Redundant Persistence: The Partial Removal Trap

The persistence mechanism is the most aggressive trait of the analyzed sample. The four scheduled tasks impersonate legitimate Windows services with names that do not raise alarm on a cursory visual check: Local Credential Manager, Network Audio Service, Windows Display Manager, Device Credential Handler. To these is added a copy in the Startup folder that guarantees execution at user logon.

The multiplicity of anchor points has an immediate practical consequence for remediation operations. If an analyst removes only the visible task or deletes files from the WinDefendSvc folder without verifying the other four mechanisms, the surviving module rebuilds the infection. Removal must be coordinated in a single operation, with a preventive scan of all known persistence vectors.

What It Exfiltrates and in What Order

Exfiltration follows a rigid hierarchy by file type that reveals intent for targeted corporate espionage. The priority documented by Securonix is: Word, PDF, PowerPoint, Excel, then archives. This sequence, according to researcher Aaron Beardslee, "indicates espionage of corporate documents rather than opportunistic crimeware."

Beyond documents, the malware collects saved Wi-Fi passwords, desktop screenshots, and clipboard text. The combination allows reconstruction of work contexts, network access credentials, and contents of copied-and-pasted communications: a collection profile that aims not for maximum volume but for the informational quality of extracted material.

"Nothing in the sample's code, infrastructure, or TTPs cleanly overlaps with the consolidated toolkit of a known APT, so we do not advance attribution claims" — Aaron Beardslee, Securonix Threat Research

Network Indicator: The Hardcoded Token

The two C2 domains — corecloudfileshare[.]xyz and attachmentsharingdrive[.]xyz — are not distributed at random: the malware employs a static hardcoded authentication token, which Securonix has already identified as a "durable, high-fidelity network indicator." The static nature of the token enables clustering of future incidents without ambiguity: any connection to those domains with that specific token belongs to the same operational infrastructure.

The mistake is revealing of the actor's profile. A mature, disciplined operator would have implemented token rotation or dynamic authentication systems. The choice of a fixed, reusable value, combined with the same copy-pasted bug in both modules, indicates tooling built on template code or reused without rigorous internal review. Beardslee defines it as "typical of a mid-tier operator rather than a mature, disciplined APT."

Immediate Actions

• Search network logs for connections to corecloudfileshare[.]xyz and attachmentsharingdrive[.]xyz, with attention to the static authentication token documented by Securonix.
• Check endpoint tools for the presence of malware hashes and the WinDefendSvc folder in user paths, not in legitimate Windows Defender paths.
• Inspect scheduled tasks with suspiciously generic names (Local Credential Manager, Network Audio Service, Windows Display Manager, Device Credential Handler) and the Startup folder for unauthorized copies.
• Plan removal as a single coordinated operation: the multi-layered persistence rebuilds autonomously if even one mechanism survives.

Why the Mid-Tier Profile Lowers the Attack Threshold

The analysis of TASK#STOMP documents a phenomenon that goes beyond the single sample. The demonstrated capabilities — redundant persistence, selective exfiltration, dual C2 channel, masquerading with native components — are techniques that until a few years ago were associated with groups possessing state-level intelligence resources. Today, an operator with template tooling and cursory review implements them successfully.

This lowers the attack threshold for sectors that are not priority targets of known APTs but still hold sensitive documentation: procurement, dual-use technologies, industrial supply chains. The competence sufficient to steal Word and PDF documents no longer requires investment in zero-days or sophisticated proprietary infrastructure. TASK#STOMP demonstrates that the gap between "mid-tier actor" and "advanced persistent threat" is now measured in implementation details, not in the capacity to cause damage.

For forensic analysts, the sample offers a rare advantage: errors that accelerate clustering and tokens that do not lie. The operator built a functional backdoor but forgot to wipe the most obvious fingerprints.

Sources

• https://www.helpnetsecurity.com/2026/09/21/taskstomp-windows-backdoor/
• https://thehackernews.com/2026/09/taskstomp-powershell-backdoor-steals.html
• https://www.sentinelone.com/labs/dont-call-us-well-call-your-apis-tradertraitor-backdoors-resurface-on-victim-with-no-crypto-ties/
• https://thehackernews.com/2026/09/iran-linked-handala-hack-tied-to.html
• https://www.welivesecurity.com/en/eset-research/lazarus-luring-employees-trojanized-coding-challenges-case-spanish-aerospace-company/
• https://thehackernews.com/
• https://thehackernews.com/p/upcoming-hacker-news-webinars.html