Malware & Tooling

USB-Worm Backdoor and Keylogger Compromise Financial Institution

Elastic Security Labs found two custom Windows malware components on a South Asian financial institution. BRUSHWORM is a modular backdoor that spreads via USB, steals documents, and downloads additional payloads.

1 source · Mar 27

Timeline

• Mar 27 Reported by Elastic Security Labs

Sources

• Mar 27 Elastic Security Labs

  Elastic Security Labs uncovers BRUSHWORM and BRUSHLOGGER — Elastic Security Labs

  Elastic Security Labs observed two custom malware components targeting a South Asian financial institution: a modular backdoor with USB-based spreading and a DLL-side-loaded keylogger.

  original

Part of the PlainSec briefing for 2026-03-27

Every edition of this story: USB-Worm Backdoor and Keylogger Compromise Financial Institution

More from today

• Coruna Exploit Kit Recycles Triangulation iOS Zero‑Days
• Trivy GitHub Actions Compromise Exposes CI/CD Secrets