An advanced malware campaign known as TASK#STOMP has recently been discovered, which utilizes a PowerShell-based backdoor to collect business documents, Wi-Fi passwords, clipboard data, and screenshots from compromised computers using a PowerShell backdoor. Moreover, the malware also provides attackers with remote command execution and maintains multiple channels for further access. VBScript files are executed via the legitimate Windows Script Host utility wscript.exe in order to initiate the infection.  In spite of the fact that the exact method of delivery has not been confirmed, phishing or social engineering could be considered possible methods of delivering the script. Following the script's delivery, it sets up a set of scheduled tasks resembling legitimate Windows components, establishing persistence.  By naming these tasks Local Credential Manager, Network Audio Service, Windows Display Manager, and Device Credential Handler, malicious activities can be blended seamlessly with normal system activities. Another persistence mechanism places another VBScript file in the Windows Startup folder, enabling it to run when the user logs in.  Upon launching the malware, it executes two PowerShell components. Among these are sys_loader.ps1, which collects documents, gathers system information, steals Wi-Fi passwords, monitors clipboards, captures screenshots, and executes remote commands. Another persistent command-and-control channel, win_conn.ps1, provides additional collection capability as well as a persistent command-and-control channel.  By monitoring each other and restarting the other process if one is disabled, this setup provides redundancy, making it more difficult to remove the malware if only one process is terminated or a single persistence entry is deleted. In addition to hiding execution activities, timestamp manipulations, and cleanup activities, Task#STOMP can also be used for continuous document theft, increasing the difficulty of detection and forensic investigation.  As opposed to collecting only files that are already present on an infected computer, TASK#STOMP monitors the file system for newly created or modified documents. This enables the collection of business files as they appear and change during an active infection. In addition to obtaining Wi-Fi credentials and clipboard contents, the malware targets saved Wi-Fi credentials as well.  With clipboard monitoring, operators can identify information temporarily copied by users, while screenshot capture allows them to view information displayed on a compromised system. By combining these capabilities with remote command execution, Task#STOMP is able to gather more information about user activity than a conventional file-stealing malware.  A separate command-and-control path, Win_conn.ps1, is maintained by TASK#STOMP in addition to data collection. From win_conn_cfg.dat, the component decodes its configuration and connects to attacker-controlled infrastructure at corecloudfileshare[.]xyz and attachmentsharingdrive[.]xyz. Researcher identification of related traffic can be improved by using a hardcoded authentication token for communication.  Parts of network communication are handled by a compiled C# component. During connection times, connections can proceed when certificates are invalid, self-signed, or otherwise mismatched due to the code disabling TLS certificate validation. This reduces the level of protection usually provided by certificate checks and makes it easier for the malware to communicate with its servers. Additionally, TASK#STOMP alters file timestamps and cleans up activity following execution to provide further anti-forensic measures.  According to the researchers, several files have been backdated to January 15, 2024, but that date is not conclusive of when the campaign began. This date was deliberately inserted by the malware, and therefore cannot be regarded as evidence of the age of the campaign. Securonix has not determined why the malware opens a page associated with irantenders[.]com in Chrome, but the page relates to government contracts and tenders in Iran.  Securonix has not established whether the site indicates a specific victim profile or why it is opened. Researchers have cautioned that the domain alone may not be sufficient to confirm the campaign's geographical or sectoral targeting. Securonix has not linked TASK#STOMP to a known threat group. Due to the use of a single compromised system, it is unclear how the overall campaign scope and duration were determined.  The initial delivery method is also unclear, although similar VBScript campaigns suggest phishing involving archive or disk image attachments as a possible route. To detect an infection, researchers recommend examining suspicious Windows Script Host and PowerShell activity that originates from writable locations, newly created scheduled tasks, and instances where PowerShell invokes the C# compiler from .NET C#.  A suspected infection can be investigated with additional evidence from PowerShell Script Block Logging, AMSI telemetry, and scheduled task records.

Firepower may destroy targets, but communication wins wars. From encrypted radios and military satellites to network-centric warfare and real-time battlefield awareness, modern armed forces rely on in...

The Escalation Loop Recorded Sunday, July 19, 2026The breaking drone exchanges and renewed air-defense engagements across the Persian Gulf demonstrate the dangerous, self-sustaining momentum of an escalation loop. Moving past the daily headlines, we examine the heavy burden placed on tactical radar operators and the stark reality of modern kinetic conflict.#Reflection #PersianGulf #AirDefense #MilitaryAnalysis #CommandAndControl #EscalationLoop #TacticalOperators #NationalSecurity #ThoughtfulAmerican #AGypsysKisshttp://www.tyounis.com

Modern warfare is no longer decided solely by tanks, aircraft, and missiles. Behind every successful military operation lies an invisible command network connecting sensors, intelligence systems, comm...

Aviation News – Airbus Defence and Space has finalized a milestone contract with the international procurement organization OCCAR to develop next-generation tactical capabilities for the French A400M military transport aircraft. The specialized upgrade program will transform the heavy airlifter into an advanced multi-mission platform capable of managing complex combat zones from the sky. The development agreement was signed on behalf of the French Directorate General of Armaments (DGA) on June 16, 2026.

The US Coast Guard will stand up a new subordinate command called the Special Missions Command (SMC) to oversee its deployable specialised forces.The coast guar

Depuis le 7 avril, ORION26 a entamé sa quatrième et ultime phase, marquant une étape majeure dans la préparation opérationnelle des forces françaises. Cette séquence, dédiée à la projection et à la ré...

President Donald Trump on Saturday warned that the US could suffer losses against Iran but called the operation "a noble mission."