A backdoor built from ordinary Windows tools keeps taking new documents

On 21 September 2026 Securonix Threat Research published an analysis of what it calls TASK#STOMP, a Windows backdoor assembled almost entirely from components that ship with the operating system. The chain begins with a randomly named VBScript on the user's desktop, and the remaining files are staged under %LOCALAPPDATA%\WinDefendSvc, a folder named to resemble a Windows service. From there the script registers four scheduled tasks from XML definitions, drops a copy of msdiag.vbs into the user's Startup folder and launches two hidden PowerShell modules. Securonix states that it cannot establish how the script reached the machine, and that process telemetry does not distinguish between phishing, a browser download, removable media, remote access and other routes of entry. No actor is named, and the report identifies neither sectors nor countries.

The four tasks carry names that imitate Windows components, and those names change between runs. The first pass used Local Credential Manager and Network Audio Service among others, the next used Network Session Agent and System Audio Controller, while the same four XML files were reused. Five files are also backdated to 15 January 2024 at 08:30, namely msdiag.vbs, diag_pack.dat, win_conn_cfg.dat, sys_loader.ps1 and win_conn.ps1. That date sits more than two years before the execution Securonix observed. The Startup copy registers the tasks again, reapplies those timestamps and restarts both PowerShell branches every time the user signs in. The script additionally opens Chrome on one specific web page, and Securonix is explicit that the role of that page is not confirmed.

Each module reads its own Base64 encoded DAT file and runs the contents in memory. One of them searches every fixed drive for documents and archives with the extensions doc, docx, pdf, ppt, pptx, xls, xlsx, zip, rar and 7z, keeps what was created or changed within the last 365 days, and takes Word, PDF, PowerPoint and Excel ahead of the archives. Once that first pass is finished a watcher is placed on each drive, so new and modified files are uploaded as they appear. Both modules also collect screenshots, saved Wi-Fi passwords and the clipboard, which is cleared afterwards, and both run whatever commands the operator sends. Each of them compiles a small C# class on the machine through csc.exe, and that class turns off certificate validation so the connection succeeds even when the server presents an invalid certificate. Traffic goes to corecloudfileshare.xyz with attachmentsharingdrive.xyz as the fallback. The modules are set up to restart one another, but Securonix found a coding defect that means that part of the routine normally does not run.

What this means for you if you manage the Windows clients

There is no update to install here. Every step in the chain is carried out by a program Microsoft itself put on the machine, and Windows Script Host, Task Scheduler, PowerShell and the C# compiler are all doing exactly what they were built for. Our assessment is that you have to look for the sequence rather than the filenames, and Securonix lands in the same place: the abnormal part is a script that creates several tasks from XML in a folder the user can write to, hidden PowerShell from that same folder, and a compiler starting moments later. Clear away one of the tasks and the other three plus the Startup copy remain, ready to rebuild the rest. The joint guidance from CISA and its partners on living off the land techniques, published on 7 February 2024, makes the same underlying point. It states that many organisations run with default logging configurations, and that such configurations do not capture the indicators of these techniques in enough detail to separate them from ordinary IT administration.

The document hunt deserves separate thought. This backdoor looks for precisely what an employee works with every day, and it keeps uploading new files for as long as it stays in place. If such a machine sat on your network for a week, the question is not what was stored on it when the intrusion began, but what anyone has saved since. Where those documents hold personal data, and they nearly always do, you also have a notification assessment to make under the GDPR. Saved Wi-Fi passwords are a step further out: the home office network and the office guest network sit in the same list.

Berigo recommends

• Turn on PowerShell script block logging (event ID 4104) and collect the logs centrally, so that you can actually read what a hidden script did.
• Alert when wscript.exe or cscript.exe starts schtasks.exe with /Create and /XML, and look especially for XML files under AppData, Temp, the desktop and the downloads folder.
• Build detection for PowerShell spawning csc.exe, and for PowerShell running a ps1 file from AppData with a hidden window.
• Hunt for several files in the same user folder that share one identical write time far back in the past, and treat that as suspicious.
• Treat cleanup as a single operation: stop the processes first, preserve the XML files and the staging folder, remove every task, the Startup file and the staged scripts together, and check after a reboot that nothing returns.