Securonix Threat Research has released new research on TASK#STOMP, a Windows backdoor designed to maintain long-term access and continuously steal business documents. The malware targets files across every fixed drive, monitors for new or modified documents and gives attackers ongoing remote access to the infected system. Key findings include: TASK#STOMP combines scheduled tasks, a Startup-folder launcher and rotating Windows-style task names to maintain persistence and evade detection.

Securonix is transforming how security operations are delivered, measured, and scaled. Our Unified Defense SIEM combines SIEM, UEBA, SOAR, TIP, and TDIR in a single cloud-native platform that helps security teams detect threats faster, investigate with context, and respond with precision.

Researchers analyzed TASK#STOMP, a Windows backdoor that hunts for business documents, exfiltrates them, and persists to steal new or modified files while also collecting Wi-Fi credentials, clipboard text, screenshots, and operator commands. Securonix says the malware uses multiple footholds, likely arrives via phishing with a ZIP or ISO/IMG attachment, and shows no clear attribution to a known APT. #TASKSTOMP #Securonix #WindowsScriptHost #VBScript #PowerShell

Securonix is transforming how security operations are delivered, measured, and scaled. Our Unified Defense SIEM combines SIEM, UEBA, SOAR, TIP, and TDIR in a single cloud-native platform that helps security teams detect threats faster, investigate with context, and respond with precision.

Securonix announced the Securonix Threat Research Agent and ThreatWatch for ThreatQ, expanding how security teams research threats, validate exposure, and turn intelligence into documented action. Built on the ThreatQ platform and connected to Securonix security operations workflows, the new capabilities help teams generate role-specific intelligence, validate emerging threats against historical telemetry, and deliver explainable findings for analysts, SOC leaders, and executives. Security teams are under growing pressure to explain what is happening, why it matters, …

Today we are joined by Aaron Beardslee, Manager of Threat Research at Securonix, discussing "Analyzing SHEET#CREEP: SHEETCREEP is up again with different config obfuscation." Securonix researchers have identified an evolved version of the SHEETCREEP espionage campaign, using a diplomatic-themed ISO phishing lure to deliver a C# remote access trojan targeting Indian diplomatic interests. The malware abuses the Google Sheets API as a stealthy command-and-control channel, with researchers identifying 91 active victim tabs, including a high-confidence target in Pakistan. The campaign, assessed with moderate confidence as linked to Pakistan-aligned APT36, has added XOR-obfuscated configurations and other anti-analysis techniques to evade detection and maintain persistent access. The research and executive brief can be found here: ⁠Analyzing SHEET#CREEP: SHEETCREEP is up again with different config obfuscation

Securonix is transforming how security operations are delivered, measured, and scaled. Our Unified Defense SIEM combines SIEM, UEBA, SOAR, TIP, and TDIR in a single cloud-native platform that helps security teams detect threats faster, investigate with context, and respond with precision.

Securonix is transforming how security operations are delivered, measured, and scaled. Our Unified Defense SIEM combines SIEM, UEBA, SOAR, TIP, and TDIR in a single cloud-native platform that helps security teams detect threats faster, investigate with context, and respond with precision.

Using deception and decoy accounts to detect threat actors

Beware of this new Windows cyberattack. Here’s what you need to know about the Microsoft FLUX#CONSOLE Windows backdoor hacking campaign.

Securonix appoints Toby Weiss to lead its AI security push. The former Fiery chief executive will oversee the company’s next phase as SOCs move from alert management towards AI-powered execution.

Securonix is transforming how security operations are delivered, measured, and scaled. Our Unified Defense SIEM combines SIEM, UEBA, SOAR, TIP, and TDIR in a single cloud-native platform that helps security teams detect threats faster, investigate with context, and respond with precision.

Raw threat intel isn't enough without real-world context. Criminal IP has partnered with Securonix to integrate exposure-based intelligence into ThreatQ, automating analysis and speeding up investigations.

Securonix is transforming how security operations are delivered, measured, and scaled. Our Unified Defense SIEM combines SIEM, UEBA, SOAR, TIP, and TDIR in a single cloud-native platform that helps security teams detect threats faster, investigate with context, and respond with precision.

: Phishers posing as Booking.com use panic-inducing blue screens to bypass security controls

Raw threat intel isn't enough without real-world context. Criminal IP has partnered with Securonix to integrate exposure-based intelligence into ThreatQ, automating analysis and speeding up investigations. [...]