other

TASK#STOMP

Windows backdoor campaign tracked under this name by Securonix, built from VBScript and PowerShell components that collect documents and hold several persistence anchors on the host.

Known aliases

TASKSTOMP

Relationships

No evidence-backed relationships are recorded.

Current clusters

security2 publishers

TASK#STOMP plants five persistence footholds from a single desktop VBScript

Securonix pulled four scheduled tasks and a Startup folder copy out of one infected machine, and the two PowerShell modules restart each other. Delete the desktop script and the backdoor keeps collecting documents.

Publishers:helpnetsecurity.comthehackernews.com

Reality

Evidence58
Adoption12
Hype gap+8
Incentives62
Confidence64