TASK#STOMP: PowerShell Backdoor for Document Theft and Remote Access
Securonix Threat Research analyzed a script-driven Windows execution chain that begins with a desktop VBScript and deploys a redundant persistence framework under %LOCALAPPDATA%\WinDefendSvc.