What: Securonix Threat Research (Akshay Gaikwad and Aaron Beardslee) disclosed TASK#STOMP on September 21, 2026 — a multi-stage Windows backdoor that leans almost entirely on native tooling (Windows Script Host, PowerShell, Task Scheduler, the .NET C# compiler) to establish long-term access and quietly exfiltrate business documents.
Who / where: Attribution is open. The chain drops a Chrome decoy pointing at an irantenders[.]com procurement page, hinting at organizations tied to tenders or Iran-related trade — but the campaign name refers to the tradecraft (scheduled tasks plus timestomping), not a confirmed actor.
Why it matters: This is a patient, collection-focused implant, not a smash-and-grab. Five persistence anchors, mutual watchdogs, backdated artifacts and a runtime-compiled TLS bypass mean a single-file cleanup leaves the infection alive. The good news: the behavioral chain — script execution, four look-alike scheduled tasks, csc.exe spawned from PowerShell, and timestomping — is loud in telemetry even when the payload itself hides.
◈ Table of Contents
01 · Campaign Profile
PHASE 01TASK#STOMP is the latest entry in Securonix's "#"-suffixed campaign naming (following FLUX#CONSOLE and others). The name is a portmanteau of the two tradecraft pillars this implant leans on hardest: abusing scheduled tasks for redundant persistence, and timestomping its artifacts to defeat timeline analysis. The analysis below is drawn from a single-host reconstruction, so campaign scale and first-seen date are not yet public.
| Attribute | Detail |
|---|---|
| Campaign name | TASK#STOMP (Securonix Threat Research) |
| Reported by | Akshay Gaikwad, Aaron Beardslee — Securonix, 2026-09-21 |
| Malware class | Multi-stage backdoor / infostealer (living-off-the-land, fileless-leaning) |
| Attribution | Unattributed No confirmed actor; procurement/Iran-tenders decoy noted |
| Primary objective | Continuous business-document exfiltration + persistent remote access |
| Core tooling | wscript.exe · powershell.exe · schtasks.exe · csc.exe · cmd.exe (all native) |
| Persistence anchors | 4 scheduled tasks + 1 Startup-folder copy = 5 independent footholds |
| C2 domains | corecloudfileshare[.]xyz (primary) · attachmentsharingdrive[.]xyz (backup) |
| Severity (CyberHawk) | HIGH Espionage-grade collection; resilient persistence; not yet mass-scale |
No CVE is involved. TASK#STOMP requires code execution on the endpoint first (phishing / social engineering). Do not treat this as a patch-and-forget item — the defense is script-execution control and behavioral detection, not a vendor update.
02 · Disclosure & Execution Timeline
PHASE 02Because the backdoor deliberately backdates its own files, the artifact timestamps are fabricated and cannot be trusted for dating. The sequence below reflects the logical execution order Securonix reconstructed, not the wall-clock time of infection.
- 1Delivery (suspected): a randomly named VBScript,
95c9050t66.vbs, lands on the user'sDesktop— consistent with phishing or social-engineering delivery. - 2Execution:
wscript.exeruns the VBS in background mode, kicking off the multi-stage chain. - 3Persistence: four XML-defined scheduled tasks are registered and a copy (
msdiag.vbs) is dropped into the Startup folder. - 4Anti-forensics: five artifacts are timestomped to
2024-01-15 08:30:00— over two years before the observed 2026 execution. - 5Activation: two hidden PowerShell modules launch, compile C# helpers via
csc.exe, and begin polling C2. - 6Decoy + cleanup: Chrome opens the
irantenders[.]compage maximized whilepurge.batstages artifact deletion. - 7Public disclosure: Securonix published the analysis on
2026-09-21; Help Net Security and others corroborated the same day.
03 · Initial Access & the Iran-Tenders Decoy
PHASE 03The confirmed entry point is a .vbs file executed from the desktop. Securonix did not recover the delivery envelope, so the vector is inferred rather than proven — but the placement, the random filename, and the Chrome decoy all point at a human-opened lure.
The initial file 95c9050t66.vbs is deliberately named to look like a random cache or temp artifact, reducing the chance a user recognises it as executable content. It runs quietly under WSH and never shows a window.
A VBScript running from Desktop, Downloads or Temp is a high-fidelity signal. Legitimate business apps almost never do this. Alert on it regardless of what the script does next.
Mid-chain, the loader opens Chrome maximized at https://www[.]irantenders[.]com/tender/tot-delete-6e137de.php. The purpose is unconfirmed — it may be a distraction to reassure the victim that a document opened, a campaign marker, or a compromised third-party page. The theme suggests targeting of organizations that deal in procurement, tenders, or Iran-related trade.
Treat the decoy URL as an IOC in its own right. Even if the page is benign now, a proxy/DNS hit to irantenders[.]com adjacent to a wscript.exe execution is a strong pivot for scoping other victims.
04 · Technical Deep Dive: The Stage Chain
PHASE 04This is where TASK#STOMP earns its name. The implant unfolds across a native-tool chain that keeps almost nothing novel on disk — the two payload files are Base64-encoded blobs (.dat) decoded and executed in memory, and the only compiled code is a tiny TLS-bypass helper built at runtime.
Two independent PowerShell processes launch with identical concealment flags. Each decodes a Base64 .dat configuration into a UTF-8 script block and executes it in memory, so the "real" logic never touches disk in cleartext.
sys_loader.ps1 is the heavyweight: document discovery, exfiltration and the primary backdoor. win_conn.ps1 is a lightweight secondary C2 channel — it can poll, screenshot, grab Wi-Fi and clipboard and run commands, but it does not scan the filesystem.
Rather than shipping a compiled binary, each module uses Add-Type to compile a small C# class at runtime via the .NET compiler. sys_loader.ps1 builds SSLFix; win_conn.ps1 builds SSLFix2. Both do the same thing: neuter TLS certificate validation so the implant can talk to its C2 over HTTPS without a valid, trusted certificate.
csc.exe or cvtres.exe as a child of powershell.exe is rare in production. Pair that parent/child with a subsequent outbound HTTPS connection and you have a near-zero-false-positive detection for compile-after-delivery malware.
Before launching fresh copies, a hidden PowerShell stage queries Win32_Process and kills any process whose command line contains sys_loader or win_conn. This guarantees exactly one live copy of each module and cleans up stale instances left by earlier scheduled-task or Startup triggers.
05 · Persistence & Anti-Forensics
PHASE 05TASK#STOMP's defining feature is redundancy. Removing one foothold does not remove the infection — the surviving anchors and the mutual watchdog rebuild it. Everything lives under %LOCALAPPDATA%\WinDefendSvc\, a folder named to impersonate a Windows Defender service.
| Anchor | Mechanism | Detail |
|---|---|---|
| Task 1 | Scheduled task | "Local Credential Manager" (task.xml) |
| Task 2 | Scheduled task | "Network Audio Service" (task2.xml) |
| Task 3 | Scheduled task | "Windows Display Manager" (task3.xml) |
| Task 4 | Scheduled task | "Device Credential Handler" (task4.xml) |
| Startup | Startup folder | msdiag.vbs in the user's Start Menu Startup path |
| Watchdog | Mutual restart | Each PS module relaunches the other if it stops |
The same four XML files are reused, but Startup re-runs rotate the display names to a second set — "Network Session Agent", "System Audio Controller", "Host Session Broker", "System Registry Handler" — so an analyst comparing two hosts may not spot the same task twice. Match on the backing XML path (%LOCALAPPDATA%\WinDefendSvc\*.xml), not the display name.
Five artifacts receive an identical LastWriteTime of 2024-01-15 08:30:00 — msdiag.vbs, diag_pack.dat, win_conn_cfg.dat, sys_loader.ps1 and win_conn.ps1. Backdating the files by more than two years is designed to push them out of the analyst's window of interest and break "recently modified" triage sorts.
Five files sharing the exact same second-precision timestamp is itself an anomaly. Hunt for clusters of identical LastWriteTime values in user-writable directories — legitimate software rarely produces them.
A batch file, purge.bat, runs via cmd.exe /C and executes a two-second timeout.exe /T 2 /NOBREAK before its suspected deletion routine. The short delay lets in-flight file handles release before artifacts are removed, reducing the on-disk evidence left behind.
Because the malware self-deletes stage files, disk forensics alone may come up empty. Prioritise Scheduled Task event logs (4698/4702), PowerShell Script Block logging (4104) and process-creation telemetry (Sysmon 1 / 4688) — those survive the cleanup.
06 · Collection & Document-Theft Engine
PHASE 06The primary module, sys_loader.ps1, is an automated document-collection engine. It is selective and bandwidth-aware — this is built to run for weeks without tripping data-transfer alarms.
| Parameter | Behaviour |
|---|---|
| Target extensions | .doc .docx .pdf .ppt .pptx .xls .xlsx .zip .rar .7z |
| Scope | All fixed drives; real-time FileSystemWatcher + periodic sweeps |
| Age filter | Files created/modified within the last 365 days |
| Size filter | ≤ 500 MB; files 10–200 MB gzip-compressed before upload |
| De-duplication | By MD5 + path + size, so the same file isn't re-sent |
| Reliability | Up to 3 upload retries; failed items re-queued for later |
Document Exfil
Office files, PDFs and archives POSTed to /upload, prioritised newest-first within the 365-day window.
Wi-Fi Credentials
Saved wireless keys harvested via netsh wlan show profile … key=clear.
Clipboard Theft
Reads (and can clear) clipboard contents through System.Windows.Forms.Clipboard.
Screen Capture
Full-screen grabs using the .NET CopyFromScreen() API for visual context.
Remote Commands
Arbitrary PowerShell executed on demand via Invoke-Expression from C2 tasking.
Host Fingerprint
Hostname, user, public/local IP, OS, timezone and geo reported at registration.
07 · C2 Infrastructure
PHASE 07Both modules speak HTTPS to two look-alike "cloud file share" domains, authenticate with a single hardcoded token, and rotate to the backup on failure. The static token is the gift here: it is identical across victims and shows up in proxy logs.
| Element | Value |
|---|---|
| Primary C2 | https://corecloudfileshare[.]xyz |
| Backup C2 | https://attachmentsharingdrive[.]xyz |
| Auth header | X-Auth-Token: rRRcoksYyhkueVRBv4V6yFDW2ZHRwdpKzJjI2wRo |
| Failover | $SRV_IDX increments and rotates domains on request failure |
| Poll interval | GET /api/c2/poll/ every 3–8 seconds |
| IP/geo lookup | checkip.amazonaws[.]com (fallback api[.]ipify[.]org) · ip-api[.]com/json/ |
| User-Agent | Spoofed Chrome 120 on Windows 10 x64 |
Local state is cached under the same WinDefendSvc folder: host_id.dat (client ID), data_progress.dat (exfil progress), diag_index.dat (file index) and data_log.log.
08 · Indicators of Compromise
PHASE 08| Filename | SHA256 |
|---|---|
| 95c9050t66.vbs / msdiag.vbs | 5251098838fab2f3192307cac99ad2d3a71b55ba1f256412d43a9dfb3b93ac58 |
| task.xml | 7a9e7b4c2f75f7de03838f5c9589148cdbefb76200ea3cf2d6f1a2288c302493 |
| task2.xml | ff12c194128d0733434ce1580691bfde5896f14ba9f360c0f6c3a622eed24312 |
| task3.xml | e46111264ebd91e80bbad85141d254930354faa0f15d3bbfaf4826adf5a53c8d |
| task4.xml | 335d19f4e757e0c36c9ef1cb4638e151aac041b7814e3eb8bda6f78ff7011f32 |
| sys_loader.ps1 | 103b4d4a666bc0a89c10c9df55f54f4be5fa111e8429c37ae14fa8f16cb50fe8 |
| diag_pack.dat | 02ba7c982b68ec8f5a1cb47c6f3969f3f2f38ea9b4ebb8833d1b8b0ba2ab1407 |
| win_conn.ps1 | 8f448080cec5cba2f0ba6a960bc3425a2d99a6767464f581d13476985eaa4a2e |
| win_conn_cfg.dat | 41231e7f5db49055dbe4246462e60077a67b1845696df3947eb1121fe392947f |
| purge.bat | bd200756b4e996a6e7cc63036aa760f9585f252c55a60cab12f29e389b96e0ef |
| Type | Indicator |
|---|---|
| C2 domain | corecloudfileshare[.]xyz |
| C2 domain | attachmentsharingdrive[.]xyz |
| Decoy URL | www[.]irantenders[.]com/tender/tot-delete-6e137de.php |
| Auth token | rRRcoksYyhkueVRBv4V6yFDW2ZHRwdpKzJjI2wRo |
| Install dir | %LOCALAPPDATA%\WinDefendSvc\ |
| Startup drop | ...\Start Menu\Programs\Startup\msdiag.vbs |
| Timestomp value | 2024-01-15 08:30:00 (LastWriteTime on 5 artifacts) |
| Task display names | Local Credential Manager · Network Audio Service · Windows Display Manager · Device Credential Handler (+ rotated variants) |
09 · Detection & Hunt Queries
PHASE 09The payload hides, but the chain is loud. Each query below is paired KQL (Microsoft Sentinel / Defender) and SPL (Splunk). Start with the behavioral hunts — they survive the self-deletion; then layer the IOC lookups.
- csc.exe / cvtres.exe child of powershell.exe (Hunt 1)
- Any process command line containing "WinDefendSvc" (Hunt 2 & 3)
- netsh wlan ... key=clear parented by script hosts (Hunt 4)
- Outbound to corecloudfileshare[.]xyz / attachmentsharingdrive[.]xyz or the static X-Auth-Token (Hunt 5)
- Clusters of five files sharing LastWriteTime 2024-01-15 08:30:00 (timestomp)
10 · MITRE ATT&CK Mapping
PHASE 10| Tactic | Technique | ID |
|---|---|---|
| Execution | Visual Basic | T1059.005 |
| Execution | PowerShell | T1059.001 |
| Execution | Windows Command Shell | T1059.003 |
| Persistence | Scheduled Task | T1053.005 |
| Persistence | Registry Run Keys / Startup Folder | T1547.001 |
| Defense Evasion | Match Legitimate Name or Location | T1036.005 |
| Defense Evasion | Timestomp | T1070.006 |
| Defense Evasion | Compile After Delivery | T1027.004 |
| Defense Evasion | File Deletion | T1070.004 |
| Discovery | Process Discovery | T1057 |
| Discovery | System Information Discovery | T1082 |
| Discovery | System Network Configuration Discovery | T1016 |
| Collection | Automated Collection | T1119 |
| Collection | Data from Local System | T1005 |
| Collection | Screen Capture | T1113 |
| Collection | Clipboard Data | T1115 |
| Credential Access | Credentials In Files | T1552.001 |
| Command & Control | Web Protocols | T1071.001 |
| Command & Control | Ingress Tool Transfer | T1105 |
| Exfiltration | Exfiltration Over C2 Channel | T1041 |
11 · Mitigation & Hardening
PHASE 11- 1Block
wscript.exe/cscript.exeexecution fromDesktop,DownloadsandTempvia AppLocker or WDAC path rules. - 2Where WSH is not needed, disable it or restrict it to signed scripts only.
- 3Sandbox or strip
.vbs,.isoand.imgemail attachments at the gateway — common script-delivery containers. - 4Enable Microsoft Defender ASR rules for script/Office child processes and obfuscated scripts.
- 1Turn on PowerShell Script Block Logging (Event ID 4104) and Module Logging fleet-wide.
- 2Enable Scheduled Task auditing (Security 4698/4702) and ship it to the SIEM.
- 3Deploy Sysmon (or Defender process telemetry) so
csc.exeparentage is captured. - 4Alert on any new file or task under
%LOCALAPPDATA%\WinDefendSvc\— a legitimate Defender service never lives there.
Because of the mutual watchdog, piecemeal removal fails. Kill the modules first, then strip all five anchors in one coordinated action, then verify nothing respawns after reboot.
- 1Stop both PowerShell modules (match command line on
sys_loader/win_conn). - 2Delete the four scheduled tasks (match backing XML in WinDefendSvc, not display name).
- 3Remove
Startup\msdiag.vbsand the entireWinDefendSvcfolder. - 4Block the two C2 domains and the decoy URL; hunt the static
X-Auth-Tokenacross proxy logs to scope other hosts. - 5Rotate any Wi-Fi keys and credentials that may have been present in stolen documents or the clipboard.
- 6Reboot and confirm no task, Startup entry or module returns.
Assume data loss. If the implant ran for any length of time, business documents from the last 365 days across all fixed drives should be treated as exfiltrated until proven otherwise.
12 · Sources & References
PHASE 12Hunt your fleet for TASK#STOMP now. Drop the SHA256 hashes, the two C2 domains and the static X-Auth-Token into our IOC Scanner, then run the KQL/SPL hunts above against your last 30 days of process and proxy telemetry. Prioritise any host with a csc.exe child of PowerShell or a WinDefendSvc folder.
For more living-off-the-land detection engineering and DFIR breakdowns, follow CyberHawk Threat Intel and browse our incident-response SOP library.
◈ Stay Connected
Follow CyberHawk Threat Intel for threat intelligence, deployment guides and hands-on SOC tooling content.
"They can't exploit you if you are the Exploit."