Elastic Security Labs uncovers BRUSHWORM and BRUSHLOGGER

Elastic Security Labs discovered two custom malware components targeting a South Asian financial institution. BRUSHWORM is a modular backdoor with USB-based spreading capabilities, while BRUSHLOGGER is a DLL-side-loaded keylogger. The attack specifically targets financial services in the South Asian region, demonstrating sophisticated techniques including USB propagation for lateral movement and DLL side-loading for persistence. This represents an active threat against critical financial infrastructure with potential for significant impact.