TASK#STOMP is a PowerShell backdoor that begins infection through VBScript execution and establishes persistence using scheduled tasks and startup folder entries. It deploys two main PowerShell payloads to scan fixed drives for business-related documents modified within the past year, excluding files over 500MB. The malware uses filesystem watchers for ongoing document collection. It also captures screenshots, steals Wi-Fi passwords, monitors clipboard data, and executes arbitrary commands. Communication with command-and-control servers occurs over domains 'corecloudfileshare.xyz' and 'attachmentsharingdrive.xyz'. The backdoor uses compiled C components to bypass TLS certificate validation, allowing connections to servers with invalid certificates. No CVE or known exploits in the wild are reported.

The malware enables persistent remote access to compromised systems and exfiltrates sensitive business documents, potentially leading to data theft and espionage. Additional impacts include credential theft (Wi-Fi passwords), monitoring of clipboard data, and the ability to execute arbitrary commands, which could facilitate further compromise or lateral movement within a network.

No official patch or remediation is indicated. Since this is malware, mitigation should focus on detection and removal using updated endpoint protection solutions and network monitoring for connections to the identified command-and-control domains. Restrict execution of unauthorized VBScript and PowerShell scripts, and monitor scheduled tasks and startup entries for suspicious activity. Validate TLS certificates on outbound connections to detect attempts to bypass certificate validation. Refer to vendor or security provider advisories for updated detection and removal tools.