[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$frte1Cau2yT4Keso8p5AlenAVRDfD9BaZRbjZFFgRKoE":3},{"article":4,"iocs":41,"watch_terms":45,"solutions":46,"lesson":122},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":24,"category":25,"article_tags":28},"bf054632-275c-4277-ab48-ee71d3be6c1b","New TASK#STOMP Windows Backdoor Enables Continuous Document Theft","new-task-stomp-windows-backdoor-enables-continuous-document-theft-b39d39","TASK#STOMP Windows backdoor uses PowerShell, scheduled tasks and runtime C# compilation to steal business documents and maintain remote access.","A new sophisticated Windows backdoor, dubbed TASK#STOMP, has been identified that leverages PowerShell and scheduled tasks for persistent access and remote control. It employs runtime C# compilation to evade detection and is designed to continuously exfiltrate sensitive business documents.","New TASK#STOMP Windows backdoor steals documents and maintains remote access.","https:\u002F\u002Fhackread.com\u002Ftaskstomp-windows-backdoor-document-theft\u002F",null,"2026-09-22T11:17:04+00:00","2026-09-22T12:00:10.79316+00:00",8,[17,20,22],{"name":18,"type":19},"PowerShell","technology",{"name":21,"type":19},"Scheduled Tasks",{"name":23,"type":19},"C#","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":24,"icon":12,"name":26,"slug":27},"Malware","malware",[29,34,36],{"category":30},{"id":31,"icon":12,"name":32,"slug":33},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":35},{"id":24,"icon":12,"name":26,"slug":27},{"category":37},{"id":38,"icon":12,"name":39,"slug":40},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[42],{"type":27,"value":43,"context":44},"TASK#STOMP","Name of the backdoor",[],{"controls":47,"vendors":121},[48,69,95],{"slug":49,"name":50,"problem":51,"products":52},"endpoint-management","Device management (MDM and UEM)","Every company laptop and phone is known, encrypted, locked down and up to date.",[53,61],{"vendor_slug":54,"vendor_name":55,"vendor_logo":56,"product_slug":57,"product_name":58,"url":59,"description":60},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"vendor_slug":62,"vendor_name":63,"vendor_logo":64,"product_slug":65,"product_name":66,"url":67,"description":68},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"slug":70,"name":71,"problem":72,"products":73},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[74,82,87],{"vendor_slug":75,"vendor_name":76,"vendor_logo":77,"product_slug":78,"product_name":79,"url":80,"description":81},"sophos","Sophos","\u002Fvendor-logos\u002Fsophos.png","sophos-endpoint","Sophos Endpoint","https:\u002F\u002Fwww.sophos.com\u002Fen-us\u002Fproducts\u002Fendpoint-security","Endpoint protection with Intercept X anti-ransomware technology and EDR.",{"vendor_slug":62,"vendor_name":63,"vendor_logo":64,"product_slug":83,"product_name":84,"url":85,"description":86},"defender-for-endpoint","Microsoft Defender for Endpoint","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fendpoint-security\u002Fmicrosoft-defender-endpoint","Endpoint detection and response for Windows, macOS, Linux and mobile devices.",{"vendor_slug":88,"vendor_name":89,"vendor_logo":90,"product_slug":91,"product_name":92,"url":93,"description":94},"bitdefender","Bitdefender","\u002Fvendor-logos\u002Fbitdefender.png","gravityzone","GravityZone","https:\u002F\u002Fwww.bitdefender.com\u002Fen-us\u002Fbusiness\u002Fgravityzone-platform\u002F","Endpoint protection, detection and response platform.",{"slug":96,"name":97,"problem":98,"products":99},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",[100,108,116],{"vendor_slug":101,"vendor_name":102,"vendor_logo":103,"product_slug":104,"product_name":105,"url":106,"description":107},"proofpoint","Proofpoint","\u002Fvendor-logos\u002Fproofpoint.png","enterprise-dlp","Proofpoint Enterprise DLP","https:\u002F\u002Fwww.proofpoint.com\u002Fus\u002Fproducts\u002Fdata-loss-prevention","Data loss prevention across email, cloud and endpoints.",{"vendor_slug":109,"vendor_name":110,"vendor_logo":111,"product_slug":112,"product_name":113,"url":114,"description":115},"netskope","Netskope","\u002Fvendor-logos\u002Fnetskope.png","netskope-dlp","Netskope DLP","https:\u002F\u002Fwww.netskope.com\u002Fproducts\u002Fdata-loss-prevention","Data loss prevention for web, cloud apps, AI tools and endpoints.",{"vendor_slug":62,"vendor_name":63,"vendor_logo":64,"product_slug":117,"product_name":118,"url":119,"description":120},"purview-dlp","Microsoft Purview Data Loss Prevention","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fdata-security-governance\u002Fmicrosoft-purview-data-security","Data classification and loss prevention across Microsoft 365, endpoints and connected cloud apps.",[],{"slug":123,"title":124,"body":125,"framework_refs":126,"framework_notes":141},"taskstomp-backdoor-uses-scheduled-tasks-and-powershell-for-stealthy-document-theft","TASK#STOMP Backdoor Uses Scheduled Tasks and PowerShell for Stealthy Document Theft","TASK#STOMP exploits Windows scheduled tasks and PowerShell — two built-in, trusted system components — to establish persistent access and continuously exfiltrate sensitive business documents without triggering standard defenses. By compiling C# code at runtime, the malware evades signature-based detection, making traditional antivirus solutions insufficient. This attack highlights the danger of leaving PowerShell unrestricted and scheduled task creation unmonitored in enterprise environments. The continuous, automated nature of the document theft means that even a brief window of undetected access can result in significant data loss with long-term business consequences.",[127,128,129,130,131,132,133,134,135,136,137,138,139,140],"CIS Control 4 – Secure Configuration of Enterprise Assets and Software","CIS Control 8 – Audit Log Management","CIS Control 13 – Network Monitoring and Defense","CIS Control 3 – Data Protection","NIST SP 800-53 AC-6 – Least Privilege","NIST SP 800-53 AU-12 – Audit Record Generation","NIST SP 800-53 SI-4 – System Monitoring","NIST SP 800-53 CM-7 – Least Functionality","NIST SP 800-53 SC-28 – Protection of Information at Rest","MITRE ATT&CK T1053.005 – Scheduled Task\u002FJob: Scheduled Task","MITRE ATT&CK T1059.001 – Command and Scripting Interpreter: PowerShell","MITRE ATT&CK T1027.004 – Obfuscated Files or Information: Compile After Delivery","GDPR Article 32 – Security of Processing","GDPR Article 33 – Notification of a Personal Data Breach",{}]