Malware · 172 days ago

USB-Worm Backdoor and Keylogger Compromise Financial Institution

Elastic Security Labs found two custom Windows malware components on a South Asian financial institution. BRUSHWORM is a modular backdoor that spreads via USB, steals documents, and downloads additional payloads.

Timeline

• Mar 27 Reported by Elastic Security Labs

Sources

1 source covering this story

• Elastic Security Labs Mar 27

  Elastic Security Labs uncovers BRUSHWORM and BRUSHLOGGER — Elastic Security Labs

  Elastic Security Labs observed two custom malware components targeting a South Asian financial institution: a modular backdoor with USB-based spreading and a DLL-side-loaded keylogger.

Part of the PlainSec briefing for 2026-03-27

Editions

• Briefing for 2026-03-27

Related stories

• Coruna Exploit Kit Recycles Triangulation iOS Zero‑Days
• Trivy GitHub Actions Compromise Exposes CI/CD Secrets