Malware

BRUSHWORM

BRUSHWORM is a custom modular Windows backdoor observed in a targeted intrusion against a financial institution in South Asia. It acts as the primary implant, establishing scheduled-task persistence, communicating with command-and-control infrastructure, downloading and executing additional DLL modules, collecting targeted files, and propagating through removable media. Its collection targets include documents, spreadsheets, presentations, archives, email stores, source code, and structured data files. When network connectivity is unavailable, BRUSHWORM can copy collected material to removable media, enabling physical exfiltration and movement of data from network-restricted or air-gapped environments. The backdoor uses socially engineered executable names on removable drives to encourage execution on additional Windows systems. It also performs basic anti-analysis checks involving display characteristics, host and user names, virtualization artifacts, and mouse activity. BRUSHWORM has been associated with BRUSHLOGGER, a separate DLL-side-loaded keylogger used in the same operation. The tooling exhibited signs of iterative development and comparatively low implementation sophistication; no threat actor attribution is established.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

16 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1091Replication Through Removable MediaEvidence4

The backdoor copies itself to connected removable storage using lure filenames including Salary Slips.exe, Documents.exe, Important.exe, and Attachments.exe.

Execution

1 technique

T1053.005Scheduled TaskEvidence3

BRUSHWORM creates a Windows scheduled task named MSGraphics to execute at user logon. A second task, MSRecorder, uses rundll32.exe to load the downloaded Recorder.dll module.

Persistence

1 technique

T1053.005Scheduled TaskEvidence3

BRUSHWORM creates a Windows scheduled task named MSGraphics to execute at user logon. A second task, MSRecorder, uses rundll32.exe to load the downloaded Recorder.dll module.

Privilege Escalation

1 technique

T1053.005Scheduled TaskEvidence3

BRUSHWORM creates a Windows scheduled task named MSGraphics to execute at user logon. A second task, MSRecorder, uses rundll32.exe to load the downloaded Recorder.dll module.

Stealth

5 techniques

T1027Obfuscated Files or InformationEvidence1

BRUSHWORM stores configuration fields encrypted with AES-CBC; BRUSHLOGGER XOR-encrypts keystroke logs using byte 0x43.

T1036MasqueradingEvidence1

BRUSHWORM, disguised as paint.exe... BRUSHLOGGER, meanwhile, masqueraded as libcurl.dll, a commonly trusted Windows library... using socially engineered filenames like Salary Slips.exe, Documents.exe, and Dont Delete.exe

T1036.005Match Legitimate Resource Name or LocationEvidence2

BRUSHLOGGER masquerades as libcurl.dll, and BRUSHWORM installs in hidden paths including C:\ProgramData\Photoes\Pics\ and C:\Users\Public\AppData\Roaming\Microsoft\Vault\.

T1140Deobfuscate/Decode Files or InformationEvidence2

The backdoor decrypts AES-CBC configuration fields using a hardcoded key and an IV prepended to each encrypted blob.

T1497.001System ChecksEvidence2

BRUSHWORM checks display resolution, username/computer name values such as 'sandbox,' CPUID hypervisor vendor strings, and mouse movement over five minutes.

Discovery

1 technique

T1497.001System ChecksEvidence2

BRUSHWORM checks display resolution, username/computer name values such as 'sandbox,' CPUID hypervisor vendor strings, and mouse movement over five minutes.

Lateral Movement

1 technique

T1091Replication Through Removable MediaEvidence4

The backdoor copies itself to connected removable storage using lure filenames including Salary Slips.exe, Documents.exe, Important.exe, and Attachments.exe.

Collection

4 techniques

T1005Data from Local SystemEvidence1

BRUSHWORM... stealing sensitive documents from infected systems.

T1025Data from Removable MediaEvidence2

Two threads target external storage devices, including a thread that enumerates and steals files from connected removable and optical drives.

T1074.001Local Data StagingEvidence2

Stolen files are staged in C:\Users\Public\Systeminfo\, while hashconfig records exfiltrated file paths and SHA-256 hashes.

T1119Automated CollectionEvidence2

The malware enumerates files on removable and optical drives and selects documents, spreadsheets, archives, email files, source code, and other files matching a broad extension list.

Command and Control

3 techniques

T1071Application Layer ProtocolEvidence1

BRUSHWORM, disguised as paint.exe, acted as the primary implant — responsible for establishing persistence, communicating with a remote command-and-control (C2) server, downloading additional payloads...

T1071.001Web ProtocolsEvidence1

The backdoor uses the WinHTTP library to issue a GET request to the C2 server at /updtdll to download a DLL payload.

T1105Ingress Tool TransferEvidence3

BRUSHWORM issues a WinHTTP GET request to the C2 URI /updtdll, writes the returned DLL as Recorder.dll, and executes it through a scheduled task.

Exfiltration

2 techniques

T1052Exfiltration Over Physical MediumEvidence1

When internet access is unavailable, the malware copies stolen files and matching files from the user's profile directory to removable drives for physical exfiltration.

T1052.001Exfiltration over USBEvidence1

In environments without active internet access, BRUSHWORM pivots to a physical exfiltration method, copying all stolen files directly to any connected USB drive to bridge air-gapped networks.

INDICATORS OF COMPROMISE

IOCs tracked for this family

2 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

1 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

1 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

domain●●●●●●●●●●●●View more in app6 months ago

hash.sha256●●●●●●●●●●●●View more in app6 months ago

ACTIVITY FEED

Recent activity

4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

4 SOURCESView more in app

cyber security newsNews

Mar 27, 2026

Hackers Deploy BRUSHWORM and BRUSHLOGGER Against South Asian Financial Firm

A modular backdoor used as the primary implant. It establishes persistence via scheduled tasks, communicates with a remote C2 server, downloads additional payloads, spreads through removable USB drives, and steals sensitive documents from infected systems. It can also copy stolen files to connected USB drives for exfiltration in offline environments.

elastic security labsNews

Mar 27, 2026

Elastic Security Labs uncovers BRUSHWORM and BRUSHLOGGER

A custom modular Windows backdoor that uses a scheduled task named MSGraphics for logon persistence, retrieves DLL payloads from its C2, and installs them through a second scheduled task. It performs basic sandbox checks, stores an AES-CBC configuration, propagates through USB devices using lure filenames, stages documents and other files for exfiltration, and can copy stolen data to USB media for physical exfiltration in offline or air-gapped environments.

elastic security labsNews

Mar 25, 2026

Elastic Security Labs uncovers BRUSHWORM and BRUSHLOGGER - Elastic Security Labs

Custom modular backdoor used as the primary implant. It establishes persistence via scheduled task, communicates with a C2 server, downloads DLL payloads, spreads through removable media, performs anti-analysis checks, and steals a broad range of files including documents, spreadsheets, email archives, and source code. It also supports offline USB-based exfiltration for restricted or air-gapped environments.

blueteamsecNews

May 8, 2023

BRUSHWORM and BRUSHLOGGER - Infosec.Pub

A custom modular backdoor with USB-based spreading observed targeting a South Asian financial institution.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching2

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping16

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

BRUSHWORM