TASK#STOMP Windows Backdoor Enables Continuous Document Theft via PowerShell and Scheduled Tasks
What Happened — Researchers identified a new Windows backdoor, dubbed TASK#STOMP, that leverages PowerShell, scheduled‑task abuse, and runtime C# compilation to silently harvest business documents and retain persistent remote access.
Why It Matters for Trust & Control Assurance
- Continuous creation of unauthorized scheduled tasks bypasses typical change‑management controls, highlighting the need for real‑time task‑creation monitoring.
- PowerShell script‑block logging and execution‑policy enforcement are essential evidence sources for an audit‑ready control‑assurance program.
- Detecting and evidencing such backdoor activity supports the access‑control objective that underpins many frameworks (NIST CSF, ISO 27001, etc.).
Who Is Affected – Any organization that runs Windows workstations or servers, especially those handling sensitive business documents (finance, legal, healthcare, SaaS providers).
Recommended Actions – Enable comprehensive PowerShell logging, enforce least‑privilege for scheduled‑task creation, deploy endpoint detection and response (EDR) with scheduled‑task telemetry, and regularly review audit logs for anomalous code execution. Source: HackRead
Technical Notes — The backdoor compiles C# code at runtime, executes via PowerShell, and registers a scheduled task for persistence. No CVE is associated; the technique exploits legitimate Windows features. Source: HackRead