TASK#STOMP PowerShell Backdoor Steals Business Documents and Maintains Persistent Remote Access

A sophisticated PowerShell-based backdoor named TASK#STOMP has been discovered that specifically targets business documents while maintaining persistent remote access to compromised systems. The infection begins with VBScript execution, establishing persistence through scheduled tasks and startup folder entries. The malware deploys two primary PowerShell payloads that scan fixed drives for Word, PDF, PowerPoint, Excel, and archive files modified within the past year, excluding files larger than 500MB. It employs filesystem watchers for continuous collection of new documents. Additional capabilities include screenshot capture, Wi-Fi password theft, clipboard monitoring, and arbitrary command execution. The backdoor communicates with two command-and-control domains and uses compiled C helpers to bypass TLS certificate validation, enabling connections to servers with invalid certificates.

• Konni Hackers Target Ukraine With Malicious LNK Files and VelvetCake PowerShell MalwareMalware2026-09-24
• BOSSAI: Inside the AI attack mesh that targeted Taiwan's emergency servicesCampaign2026-11-04
• Hackers Impersonate IT Help Desk on Microsoft Teams to Hijack Active Directory Accounts and Steal DataMalware2026-10-31
• Belarus-Linked Hackers Deploy Wiper Malware in First Documented Destructive Attack on UkraineMalware2026-10-30
• n0n Ransomware: Inside an AI-Assisted Extortion OperationMalware2026-10-28