Security researchers have uncovered a malware campaign dubbed TASK#STOMP, which employs a sophisticated PowerShell backdoor to conduct persistent, silent data theft within compromised Windows environments. The attack framework focuses on automated intelligence gathering, posing a significant threat to enterprises by leveraging legitimate system tools to evade detection.
According to an analysis reported by The Hacker News, TASK#STOMP operates entirely in memory via PowerShell, allowing it to blend with normal administrative activity. Its core functionality is built for comprehensive and continuous data exfiltration rather than immediate disruption.
A key feature is its real-time file system watcher, which actively monitors for newly created or modified files, enabling attackers to steal information the moment it is generated. This method represents an advancement over techniques that only capture data present at the time of initial infection.
The backdoor’s toolkit is extensive. It automatically harvests existing business documents, steals saved Wi-Fi passwords, captures clipboard contents, and takes screenshots. It also serves as a remote access point, accepting commands from its operators.
The campaign underscores the growing challenge of "living-off-the-land" attacks, where adversaries use native tools like PowerShell to bypass traditional signature-based defenses. For security teams, this necessitates a focus on behavioral monitoring and enhanced logging.
The most critical defensive measure recommended is enabling PowerShell Script Block Logging and Module Logging. These Windows features capture the actual commands executed, providing vital forensic data for detecting in-memory attacks.
Additionally, organizations should consider implementing PowerShell Constrained Language Mode to limit available script functionality. Network monitoring should be tuned to detect anomalies such as unexpected PowerShell process spawning, connections to unknown external addresses, and large data uploads.
While the initial delivery vector for TASK#STOMP remains unspecified, common methods like phishing are probable. No threat actor has been attributed yet, placing the immediate priority on defensive postures.
The emergence of TASK#STOMP highlights that effective threats often operate quietly within an organization’s own processes. For IT professionals, ensuring visibility into script execution and maintaining vigilant network monitoring are now essential components of enterprise defense.
安全研究人員發現了一個名為 TASK#STOMP 的惡意軟件活動，該活動採用複雜的 PowerShell 後門，在被入侵的 Windows 環境中進行持續的、靜默的數據竊取。這個攻擊框架專注於自動化情報收集，透過利用合法的系統工具來規避偵測，對各大企業構成重大威脅。
根據 The Hacker News 的分析報道，TASK#STOMP 完全透過 PowerShell 在記憶體中運作，使其能夠與正常的系統管理活動混合。其核心功能是為全面且持續的數據外洩而設計，而非立即的系統破壞。
一個關鍵特點是其即時檔案系統監視器，該監視器會主動監控新建立或修改過的檔案，使攻擊者能在資訊生成的瞬間就將其竊取。這種方法相較於僅能捕獲初次感染時存在數據的技巧，是一個明顯的進步。
該後門的工具包非常豐富。它會自動收集現有的商業文件、竊取已儲存的 Wi-Fi 密碼、擷取剪貼簿內容並進行螢幕截圖。它同時亦是一個遠端存取點，接收來自其操作者的指令。
該活動凸顯了「就地取材」攻擊日益嚴峻的挑戰，攻擊者利用 PowerShell 等原生工具來繞過傳統的特徵碼防禦機制。對於安全團隊而言，這要求他們必須專注於行為監控和增強的日誌記錄。
最被推薦的關鍵防禦措施是啟用 PowerShell 腳本區塊記錄 和 模組記錄。這些 Windows 功能會捕獲實際執行的命令，為偵測記憶體攻擊提供至關重要的取證數據。
此外，組織應考慮實施 PowerShell 受限語言模式，以限制可用的腳本功能。網絡監控應調整至能偵測異常狀況，例如意外的 PowerShell 程序生成、連接至未知外部地址以及大量數據上傳。
雖然 TASK#STOMP 的初始傳送途徑尚未明確，但釣魚攻擊等常見手法是可能的途徑。目前尚未有任何威脅行為者被歸因，因此當務之急是強化防禦態勢。
TASK#STOMP 的出現凸顯了一個事實：有效的威脅往往在組織自身的流程內悄然運作。對於資訊科技專業人士來說，確保對腳本執行的可見性並保持警覺的網絡監控，現已成為企業防禦體系中不可或缺的組成部分。