"automatically harvests and exfiltrates business documents, watches the filesystem for new files in real time, steals Wi‑Fi passwords and clipboard contents, takes screenshots, and accepts arbitrary remote commands through two redundant, token‑authenticated C2 servers," Securonix researchers Akshay Gaikwad and Aaron Beardslee wrote in their disclosure.
The researchers were describing a newly observed campaign they have named TASK#STOMP: a VBS‑driven framework that hands follow‑on work to hidden PowerShell processes and dynamically compiled .NET code, and that is explicitly designed to collect documents, credentials, clipboard data and screenshots while keeping channels to its operators open even if one component is removed.
VBScript orchestrator and persistence
The operation begins with wscript.exe executing an encoded Visual Basic Script staged on a victim's desktop under the random name "95c9050t66.vbs." Securonix notes the filename appears intentionally random, likely to evade filename‑based detection.
The VBScript acts as an orchestrator: it creates scheduled tasks with innocuous names — Local Credential Manager, Network Audio Service, Windows Display Manager and Device Credential Handler — to blend into routine system activity and establish persistence. As a backup, the installer drops a second script, "msdiag.vbs," into the Windows Startup folder to run at user logon. The installer also runs PowerShell to terminate prior instances and ensure only a single active session runs at any time.
Those measures are paired with timestomping, hidden execution and cleanup behavior — techniques the researchers say are intended to frustrate cursory administrative reviews and turn forensic analysis into a harder problem.
PowerShell modules: sys_loader.ps1 and win_conn.ps1
After the VBS stage, the campaign launches two hidden PowerShell commands as separate processes. One, sys_loader.ps1, decodes a data blob named "diag_pack.dat" and activates the document‑stealing, surveillance and remote‑access capabilities. The other, win_conn.ps1, decodes "win_conn_cfg.dat" and constructs a secondary, persistent command‑and‑control (C2) channel capable of command execution and data collection.
Splitting functionality into separate processes provides both functional separation and operational redundancy; Securonix observed that the modules implement a mutual‑watchdog relationship. "diag_pack.dat" checks whether win_conn.ps1 is running and restarts it if not, and win_conn.ps1 performs the same check for the diagnostic module.
The cyber insurance questionnaire just landed. Now what?
SOC 2, HIPAA, insurance renewals - someone has to own security strategy. Nubivance provides fractional CISO leadership without the full-time salary.
Get a security leadC2 infrastructure, cleanup, and a curious browser action
Both PowerShell components communicate with the same externally hosted C2 infrastructure: corecloudfileshare[.]xyz or attachmentsharingdrive[.]xyz. The channels are described as token‑authenticated, and the campaign supports arbitrary remote commands along with continuous collection and exfiltration.
At the end of the chain the VBScript opens Google Chrome in a maximized window to a URL hosted at irantenders[.]com — a searchable database of tenders and contracts issued by Iranian government departments and local authorities. The disclosure says the purpose of this user‑facing web action is unknown.
Also launched is a batch script named "purge.bat" that invokes a two‑second delay and likely performs cleanup to erase traces of malicious activity; the contents of that batch file were not recovered and remain unknown, the researchers report.
Data collection goals and techniques
Securonix summarizes the campaign's end goals succinctly: continuous collection of business documents, credential and clipboard theft, screenshot capture, redundant C2 communications, and arbitrary code execution. Specific collection behaviors observed include stealing Wi‑Fi passwords, harvesting system metadata and business documents, monitoring the filesystem in real time for newly modified files, copying clipboard contents and taking screenshots.
The researchers highlight that TASK#STOMP relies heavily on native Windows components — Windows Script Host, PowerShell, Task Scheduler and the .NET toolchain — and dynamically compiled C# code, thereby reducing dependence on conventional executable payloads and making malicious actions harder to distinguish from legitimate administrative activity.
What this means for technologists, procurement teams, and end users
- Technologists and security teams: look for unexpected .vbs files on user desktops, scheduled tasks that use benign‑sounding names, hidden PowerShell processes named sys_loader.ps1 or win_conn.ps1, and outbound traffic to corecloudfileshare[.]xyz or attachmentsharingdrive[.]xyz. Watch for evidence of timestomping, scripted cleanup (purge.bat) and mutual‑watchdog process relationships.
- Procurement and enterprise leaders: TASK#STOMP's explicit aim to exfiltrate business documents and Wi‑Fi credentials — combined with redundant persistence mechanisms — raises the risk that removal will require coordinated detection and eradication rather than single‑step fixes.
- End users: the presence of unexpected VBScript files, sudden browser windows opening to external sites such as irantenders[.]com, or unexplained scheduled tasks should be reported to IT; Securonix documents these behaviors as part of the campaign's visible footprint.
TASK#STOMP is an example of an operation that trades flashy, standalone binaries for a quieter dependence on built‑in Windows tooling and redundancy across scripting and scheduling mechanisms. The researchers note the initial access vector is unclear — possibly phishing or social engineering — and they could not recover the contents of purge.bat, leaving questions about how some cleanup and cover‑up actions are finalized. For defenders, the central challenge is not only spotting the malicious activity, but recognising that it is trying very deliberately to look like ordinary system maintenance.
Original reporting: The Hacker News
