Malware & Tooling

USB-worm backdoor and keylogger compromise financial institution

Elastic Security Labs found two custom Windows malware components on a South Asian financial institution. BRUSHWORM is a modular backdoor that spreads via USB, steals documents, and downloads additional payloads.

1 source · Mar 27

Timeline

• Mar 27 Reported by Elastic Security Labs

Sources

• Mar 27 Elastic Security Labs

  Elastic Security Labs uncovers BRUSHWORM and BRUSHLOGGER — Elastic Security Labs

  Elastic Security Labs observed two custom malware components targeting a South Asian financial institution: a modular backdoor with USB-based spreading and a DLL-side-loaded keylogger.

  original

Part of the PlainSec briefing for 2026-03-27

Every edition of this story: USB-worm backdoor and keylogger compromise financial institution

More from today

• Coruna exploit kit recycles Triangulation iOS zero‑days
• Trivy GitHub Actions compromise exposes CI/CD secrets