Loading story…
Elastic Security Labs reported an intrusion at a South Asian financial institution involving two custom malware families: BRUSHWORM, a modular backdoor deployed as paint.exe, and BRUSHLOGGER, a keylogger masquerading as libcurl.dll. BRUSHWORM established persistence through scheduled tasks, contacted a command-and-control server, downloaded additional DLL payloads, and stole files including documents, spreadsheets, email archives, and source code. The malware also spread through removable media, giving the operator a way to move data and malware across disconnected environments.
BRUSHLOGGER was delivered through DLL side-loading and used a low-level keyboard hook to capture system-wide keystrokes along with active window context, storing XOR-obfuscated logs under C:\programdata\Photoes\. Elastic said the tooling showed relatively low sophistication, with basic anti-analysis checks and an AES-CBC encrypted configuration using a hardcoded key, but still provided a functional collection platform for persistence, credential and data theft, USB propagation, and air-gap bridging. Earlier samples such as V1.exe, V2.exe, and V4.exe found on VirusTotal suggested the malware had been iteratively developed by the threat actor.
See the actors and campaigns active against you right now.
2 events from the most recent confirmed update back to the earliest known activity.
Elastic Security Labs publicly disclosed detailed technical findings on BRUSHWORM and BRUSHLOGGER, including malware behavior, persistence mechanisms, encrypted configuration details, and the operational C2 string. The report also noted earlier test samples on VirusTotal, suggesting iterative development by a relatively inexperienced actor.
Elastic Security Labs analyzed an intrusion targeting a financial institution in South Asia and identified two custom malware components: the BRUSHWORM modular backdoor and the BRUSHLOGGER keylogger. The tooling included persistence, command-and-control communications, USB propagation, DLL side-loading, and keystroke capture.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
3 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourceelastic.co
Open sourceinfosec.pub
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Elastic Security Labs investigated an intrusion at a South Asian financial institution involving **BRUSHWORM**, a modular custom backdoor, and **BRUSHLOGGER**, a DLL side-loaded keylogger. BRUSHWORM establishes persistence through scheduled tasks, retrieves DLL payloads from command-and-control infrastructure, spreads via removable media, and collects documents, archives, emails, source code, and other data. It can also stage stolen files on USB devices for physical exfiltration from restricted or air-gapped networks. BRUSHLOGGER masquerades as `libcurl.dll` and is side-loaded to capture system-wide keystrokes along with active-window context, storing logs locally with XOR obfuscation. Historical samples named `V1.exe`, `V2.exe`, and `V4.exe` indicate iterative development. Elastic assessed with moderate confidence that the error-prone tooling was created by a relatively inexperienced developer, while the campaign's removable-media propagation and offline collection capabilities create particular risk for segmented financial environments.
Sep 9, 2026
China-aligned threat group **Webworm** has expanded its espionage toolkit with two custom backdoors, **GraphWorm** and **EchoCreep**, using trusted cloud and social platforms for command-and-control. Researchers said **GraphWorm** is a Go-based implant that abuses **Microsoft OneDrive** through the **Microsoft Graph API**, creating a separate workspace for each victim and using cloud folders for tasking, file transfer, shell command execution, configurable sleep intervals, and data exfiltration. **EchoCreep** was observed using **Discord** for C2, while the group also staged malware and supporting tools from a GitHub repository masquerading as a WordPress fork. The activity reflects a broader shift by Webworm away from older RATs such as **Trochilus** and **9002 RAT** toward stealthier proxy and tunneling infrastructure, including **SoftEther VPN**, **WormFrp**, **ChainWorm**, **SmuxProxy**, and **WormSocket**. Victims span government and enterprise organizations across Asia and Europe, including entities in **Belgium, Italy, Serbia, Poland, and Spain**, as well as a university in **South Africa**; researchers also linked a compromised **Amazon S3** bucket to proxy configuration storage and exfiltrated data, including VM snapshots and government documents. Investigators observed the group using tools such as **Nuclei** and **dirsearch**, along with a script exploiting a known post-authentication RCE flaw in **SquirrelMail**, indicating active targeting of exposed web applications for initial access.
Jun 29, 2026
Multiple phishing campaigns delivered **SnakeKeylogger**, **VIPKeylogger**, and **Agent Tesla** through layered infection chains that used obfuscated VBScript or PowerShell droppers, steganographic payload staging on Cloudinary, Internet Archive abuse, reflective in-memory .NET loading, and process hollowing into legitimate Windows binaries such as `Caspol.exe`, `Aspnet_compiler.exe`, and `RegAsm.exe`. One DHL-themed operation used a VIPKeylogger variant identified as a SnakeKeylogger rebrand, while a separate GuLoader campaign targeted Italian businesses with NSIS-wrapped stealers and business email compromise-style lures. Across the campaigns, the malware stole browser passwords, email and FTP credentials, Outlook and WinSCP secrets, Discord tokens, Wi-Fi passwords, screenshots, clipboard data, and keystrokes, then exfiltrated data over **SMTP**, **Telegram**, and **FTP**. Investigators found repeated operator OPSEC failures that exposed active criminal infrastructure and victim data. A VIPKeylogger/SnakeKeylogger operator left a stock **XAMPP** dashboard and internet-accessible **WinRM** open on `144.172.105.88`, while sandboxing captured plaintext SMTP credentials tied to `result@miniorangeman.com` on `185.196.9.150`; although that C2 was taken offline shortly after detection, the Cloudinary-hosted payload and SMTP infrastructure reportedly remained live. In a separate GuLoader operation, an open FTP directory on `holzbrenzii[.]com` exposed **52 credential dumps from 27 victim machines** in real time. Another SnakeKeylogger v4.4 campaign linked distinct droppers to the same backend through shared C2 strings, DDNS infrastructure, and staging artifacts, showing that technically capable malware operators repeatedly undermined their own campaigns by exposing panels, credentials, and stolen data.
Jun 29, 2026