[task-stomp]

September 22, 2026

• TASK#STOMP: Securonix detailed a Windows backdoor built from native scripting — a VBScript orchestrator launched via wscript.exe plus hidden PowerShell stages (sys_loader.ps1 decoding diag_pack.dat). It keeps five persistence footholds: four scheduled tasks named to blend in (Local Credential Manager, Network Audio Service, Windows Display Manager, Device Credential Handler) and a Startup-folder script. It exfiltrates business documents, watches the filesystem in real time, steals Wi-Fi passwords and clipboard contents, takes screenshots and accepts arbitrary commands over two token-authenticated C2s, with timestomping and cleanup to frustrate triage. Initial access is not established. The Hacker News, Securonix · Threat Activity

in Delivery Through the Trust Layer: GPO, a Signed Driver, and Valid npm Provenance