TASK#STOMP PowerShell Backdoor Harvests Documents, Wi‑Fi Passwords, and Clipboard Data
What Happened — Researchers uncovered a new campaign, TASK#STOMP, that drops a PowerShell‑based backdoor. The payload silently collects business documents, Wi‑Fi credentials, clipboard contents, screenshots, and streams new files in real time for exfiltration.
Why It Matters for Trust & Control Assurance
- Continuous monitoring of PowerShell execution and script‑block logging is a core control objective that this attack directly evades.
- Evidence of data‑exfiltration activity must be captured in real time to satisfy audit‑ready logging and incident‑response requirements.
- The scenario underscores the need for a unified control‑mapping platform that can tie PowerShell‑related detections to multiple frameworks (e.g., NIST CSF 2.0 Detect function).
Who Is Affected – Any organization that permits PowerShell on Windows workstations or servers, especially enterprises with remote‑work setups and managed‑service providers.
Recommended Actions
- Enable PowerShell script‑block logging, transcription, and module logging across the environment.
- Deploy endpoint detection & response (EDR) solutions that flag anomalous PowerShell behavior and exfiltration patterns.
- Map PowerShell activity to your control‑assurance framework and collect the logs as defensible audit evidence. Source: The Hacker News
Technical Notes – The backdoor is delivered via a malicious PowerShell command that runs in memory, avoiding disk writes. It leverages native Windows APIs to read Wi‑Fi profiles, clipboard buffers, and file system events. No public CVE is associated; the threat relies on script execution rather than a software flaw. Source: same