Plan
active
TASK#STOMP PowerShell Backdoor Harvests Docs, Wi-Fi Creds, Clipboard
- Engineer — Learn: No CVE, no patch surface, and no enrichment signals indicating active exploitation of a specific software component — the campaign details inform threat modeling but require no immediate engineering action.
- SOC/IR — Plan: The documented capabilities — real-time filesystem monitoring, clipboard theft, screenshot capture, and Wi-Fi credential harvesting via PowerShell — map to detectable ATT&CK techniques; build or tune detections for PowerShell processes performing bulk file enumeration and outbound data staging this quarter.
- Leader — Skip
This entry was curated and judged by AI (Claude) with automated enrichment
(CISA KEV / EPSS / public PoC). Verify against the original source before
acting. Found a bad verdict?
Report it —
confirmed errors go to the corrections log.