Threat Intelligence Brief
Curated summary with source attribution
Source: thehackernews.com
Threat Risk: High
Victim: Corporate environments
Incident: Deployment of the TASK#STOMP PowerShell backdoor for data theft and remote access.
Impact: Exfiltration of sensitive business documents and credentials alongside full system compromise.
Attacker: Unidentified threat actors
Analysis: The TASK#STOMP campaign utilizes a complex infection chain starting with VBScripts to establish redundant persistence via scheduled tasks and startup folders. By employing living-off-the-land techniques and timestomping, the attackers blend in with legitimate system activity to evade detection. The final stage deploys specialized PowerShell modules for comprehensive data theft and remote C2 control.
Recommendations: Monitor for unusual wscript.exe or powershell.exe executions originating from user directories.; Audit scheduled tasks for suspicious names like Local Credential Manager or Network Audio Service.; Implement strict egress filtering to block communication with unauthorized cloud-sharing domains.
Source: The Hacker News / Securonix
Editorial note: this post summarizes third-party reporting and links to the original source.
View Original Source