Actor Profile

TASK#STOMP is a newly disclosed campaign (not a named threat actor group) that delivers a sophisticated PowerShell-based backdoor framework. The campaign's origin and attribution remain unknown. The motivation appears to be intelligence collection and data exfiltration, with a focus on harvesting business documents, credentials, and system information. The initial access vector is suspected to be email-based phishing or social engineering, though the exact delivery mechanism has not been confirmed. The campaign demonstrates advanced operational security through the use of native Windows utilities, redundant persistence mechanisms, and anti-forensic techniques including timestomping and cleanup routines.

TTPs (Tactics, Techniques, Procedures)

The campaign leverages native Windows scripting and administrative tools to evade detection. Initial execution uses wscript.exe to run an encoded VBScript (T1059.005 Visual Basic) with randomized filenames for evasion. Persistence is established through multiple scheduled tasks (T1053.005 Scheduled Task/Job) disguised with legitimate-sounding names and a backup Windows Startup folder mechanism (T1547.001 Registry Run Keys / Startup Folder). The malware performs defense evasion via timestomping (T1070.006 Timestomp), hidden execution, and process termination to ensure single-session operation. Discovery activities include system metadata collection and Wi-Fi password harvesting. Credential access involves clipboard monitoring (T1115 Clipboard Data) and Wi-Fi credential theft (T1555 Credentials from Password Stores). Collection capabilities include automated document exfiltration (T1005 Data from Local System), real-time filesystem monitoring, and screenshot capture (T1113 Screen Capture). Command and control uses token-authenticated connections to redundant C2 servers with mutual-watchdog processes that restart each other if terminated. The framework executes arbitrary PowerShell commands (T1059.001 PowerShell) for remote access.

Targets & Patterns

No specific targeted sectors or geographic regions have been identified in the disclosed campaign. However, the malware's focus on harvesting "business documents" and the final-stage action of opening an Iranian government tender database (irantenders[.]com) suggests potential interest in organizations involved in Iranian government contracting or business operations. The purpose of the Iran tender website interaction remains unclear—it could serve as a decoy to distract victims, a signal to operators, or indicate targeting of entities monitoring Iranian government procurement. The broad data collection capabilities (documents, credentials, clipboard, screenshots) suggest the campaign could be adapted for various target profiles including corporate espionage, government intelligence collection, or pre-ransomware reconnaissance.

Historical Context

TASK#STOMP represents a newly disclosed campaign with no publicly documented links to previous operations or known threat actor groups. The campaign's reliance on native Windows utilities (VBScript, PowerShell, Task Scheduler, .NET) follows established patterns seen across multiple APT and cybercrime groups seeking to blend malicious activity with legitimate administrative operations. The use of redundant persistence mechanisms and mutual-watchdog processes demonstrates operational maturity, though these techniques are not unique to any specific actor. The connection to Iranian government tender websites is a novel element not previously associated with known campaigns, though its significance remains unclear. Without additional attribution indicators or infrastructure overlaps with known operations, TASK#STOMP currently stands as an isolated campaign requiring further investigation to establish potential links to existing threat actor ecosystems.

Defensive Recommendations

  • Monitor wscript.exe and cscript.exe execution of VBScript files, especially those with randomized filenames or staged in user directories (Sysmon Event ID 1, process creation with parent wscript.exe)
  • Audit scheduled tasks for suspicious entries masquerading as legitimate Windows services (e.g., 'Local Credential Manager', 'Network Audio Service') using Task Scheduler logs (Event ID 4698) and baseline legitimate task names
  • Detect PowerShell execution with encoded commands, Base64 decoding operations, or loading of .dat files as potential payloads via PowerShell script block logging (Event ID 4104) and command-line auditing
  • Monitor for timestomping activity (T1070.006) by correlating file creation timestamps with $STANDARD_INFORMATION and $FILE_NAME MFT attributes using forensic tools or NTFS journal monitoring
  • Implement network monitoring for C2 beaconing to domains using file-sharing or cloud-storage naming conventions (e.g., 'fileshare', 'attachmentsharing', 'drive') with token-based authentication patterns, and block the IOCs corecloudfileshare[.]xyz and attachmentsharingdrive[.]xyz