Executive Summary
Securonix Threat Research has identified a sophisticated campaign dubbed TASK#STOMP, which utilizes a script-driven execution chain to install a resilient espionage framework. The attack begins with a VBScript loader that establishes persistence through four rotating scheduled tasks and a Startup folder entry, masquerading as legitimate Windows services like 'Local Credential Manager' or 'Network Audio Service' to evade detection.
Technical analysis reveals a highly operational backdoor capable of automated business document harvesting, real-time filesystem monitoring, Wi-Fi password theft, and screenshot capture. The malware features redundant command-and-control (C2) channels and uses runtime C# compilation via the .NET compiler (csc.exe) to dynamically bypass TLS certificate validation. These techniques, combined with systematic timestomping and mutual-watchdog processes, demonstrate a high level of operational maturity designed to frustrate forensic reconstruction.
While the primary objective appears to be persistent document collection and espionage, the backdoor's ability to execute arbitrary PowerShell commands allows operators to deploy additional payloads or initiate disruptive activities at any time. Organizations should prioritize monitoring for anomalous Windows Script Host and PowerShell activity originating from user-writable AppData directories.