Topic

PowerShell backdoors

Remote-access malware built in PowerShell and other built-in Windows scripting instead of compiled executables, usually loaded by a script stager.

Current clusters

security2 publishers

TASK#STOMP plants five persistence footholds from a single desktop VBScript

Securonix pulled four scheduled tasks and a Startup folder copy out of one infected machine, and the two PowerShell modules restart each other. Delete the desktop script and the backdoor keeps collecting documents.

Publishers:helpnetsecurity.comthehackernews.com

Reality

Evidence58
Adoption12
Hype gap+8
Incentives62
Confidence64