What happened
On 21 September 2026, Securonix published its analysis of TASK#STOMP using process telemetry and decoded payloads from one infected Windows system. The observed chain began with C:\Users\researcher\Desktop\95c9050t66.vbs and staged files under %LOCALAPPDATA%\WinDefendSvc. The installer created four scheduled tasks, copied msdiag.vbs into the user’s Startup folder, launched hidden sys_loader.ps1 and win_conn.ps1 processes, and used PowerShell to compile C# helpers at runtime.
The initial task names were Local Credential Manager, Network Audio Service, Windows Display Manager and Device Credential Handler. The decoded payloads searched fixed drives for recent business documents and archives, watched for newly created or changed files, extracted saved Wi-Fi passwords, captured clipboard text and screenshots, and accepted arbitrary PowerShell commands. The paired modules used redundant persistence and command channels, making incomplete removal capable of leaving the infection operational.
The backdoor used corecloudfileshare[.]xyz and attachmentsharingdrive[.]xyz with the static X-Auth-Token value rRRcoksYyhkueVRBv4V6yFDW2ZHRwdpKzJjI2wRo. The cited sources did not establish when the campaign began, how broadly it spread or how the initial VBScript was delivered. Attribution posture: Securonix found no clean overlap with a known threat actor’s established toolkit and made no actor attribution. The cited source did not publish the precise timeline detail described as Campaign start, scale and delivery route.
Why this matters now
TASK#STOMP combines ordinary Windows components into a persistence and collection framework that can survive partial cleanup. The decision for security operations is whether detection logic correlates the whole chain: script execution from a user-controlled location, task creation from local XML, Startup-folder persistence, hidden PowerShell, runtime C# compilation and repeated command-server polling. Detecting one filename or task name is insufficient.
The payload’s collection priorities are enterprise-relevant. It searches fixed drives for recent Word, PDF, PowerPoint, Excel and archive files, monitors new or modified files, steals saved Wi-Fi keys and clipboard text, captures screenshots and executes arbitrary PowerShell. A positive indicator should therefore trigger data-exfiltration and credential-compromise procedures, not a routine malware-cleaning ticket.
The research derives from one infected host, so prevalence, victim sectors and delivery method remain unresolved. That limits claims about campaign scale but does not reduce the value of the static token, domains, paths and persistence sequence as immediate hunting pivots.
The decision for security leaders
Assign the hunt as a combined endpoint, network and data-loss investigation. Endpoint-only searches may find task or file artefacts but miss the static network token; network-only searches may miss dormant persistence. A positive signal should open an incident because the payload provides continuous collection and unrestricted command execution.
Require responders to preserve task XML, PowerShell logs, AMSI evidence, staged files, compiler artefacts and network telemetry before eradication. Removal should stop both PowerShell branches and eliminate every scheduled task, Startup copy and staged component before reboot validation.
Treat saved Wi-Fi keys, clipboard contents and accessible business documents as exposed when execution is confirmed. Containment owners should rotate affected network credentials, determine document access scope and review operator commands rather than closing after an antivirus scan.
Evidence of closure
- EDR and network searches return no unexplained matches for the published indicators.
- Forensic review accounts for every scheduled task, Startup artefact and staged payload.
- Reboot validation confirms neither PowerShell branch nor persistence mechanism returns.
- Credential rotation and document-scope analysis are recorded for every confirmed host.
The Security.io assessment
The original research supplies actionable infrastructure, paths, persistence names and a static authentication token. Independent reporting confirms that the analysis was derived from one endpoint and that Securonix is not claiming known-actor attribution or measured campaign scale. Confidence is therefore high in the analysed malware behaviour but only medium in conclusions about prevalence and targeting.
The strongest detection opportunity is behavioural correlation. Individual elements such as PowerShell, scheduled tasks, runtime C# compilation and Startup-folder persistence can be legitimate. Their sequence under a user-writable WinDefendSvc path, followed by certificate-validation bypass and communication with the two published domains, is substantially more discriminating.
The cited sources did not establish when the campaign began, how broadly it spread or how the initial VBScript was delivered. Absence of those facts should keep sector and regional targeting unresolved. Organisations should use positive local telemetry, not the IranTenders-themed browser launch, to determine exposure and incident severity.
Questions for the morning meeting
- Can endpoint telemetry identify script hosts creating tasks from XML stored in user profiles?
- Are PowerShell runtime-compilation chains retained and correlated with network activity?
- Can responders remove scheduled tasks, Startup persistence and staged files in one coordinated action?
- Do proxies or network sensors expose the static TASK#STOMP authentication token?