Malware · 217 days ago

USB-worm backdoor and keylogger compromise financial institution

Elastic Security Labs found two custom Windows malware components on a South Asian financial institution. BRUSHWORM is a modular backdoor that spreads via USB, steals documents, and downloads additional payloads.

Timeline

• Mar 27 Reported by Elastic Security Labs

Sources

1 source covering this story

• Elastic Security Labs Mar 27

  Elastic Security Labs uncovers BRUSHWORM and BRUSHLOGGER — Elastic Security Labs

  Elastic Security Labs observed two custom malware components targeting a South Asian financial institution: a modular backdoor with USB-based spreading and a DLL-side-loaded keylogger.

Part of the PlainSec briefing for 2026-03-27

Editions

• Briefing for 2026-03-27

Related stories

• Coruna exploit kit recycles Triangulation iOS zero‑days
• Trivy GitHub Actions compromise exposes CI/CD secrets