Loading story…
Elastic Security Labs investigated an intrusion at a South Asian financial institution involving BRUSHWORM, a modular custom backdoor, and BRUSHLOGGER, a DLL side-loaded keylogger. BRUSHWORM establishes persistence through scheduled tasks, retrieves DLL payloads from command-and-control infrastructure, spreads via removable media, and collects documents, archives, emails, source code, and other data. It can also stage stolen files on USB devices for physical exfiltration from restricted or air-gapped networks.
BRUSHLOGGER masquerades as libcurl.dll and is side-loaded to capture system-wide keystrokes along with active-window context, storing logs locally with XOR obfuscation. Historical samples named V1.exe, V2.exe, and V4.exe indicate iterative development. Elastic assessed with moderate confidence that the error-prone tooling was created by a relatively inexperienced developer, while the campaign's removable-media propagation and offline collection capabilities create particular risk for segmented financial environments.
See the actors and campaigns active against you right now.
2 events from the most recent confirmed update back to the earliest known activity.
Elastic Security Labs identified the BRUSHWORM modular backdoor and BRUSHLOGGER DLL side-loaded keylogger on infrastructure belonging to a South Asian financial institution. BRUSHWORM maintained scheduled-task persistence, stole and staged files, and could copy data to removable media for offline exfiltration, while BRUSHLOGGER captured system-wide keystrokes.
Researchers identified BLOODALCHEMY, an x86 shellcode backdoor associated with the REF5961 intrusion set. The observed chain likely used a malicious BrLogAPI.dll side-loaded by Brother Industries' BrDifxapi.exe to inject the payload into a signed process; Elastic also created YARA detection rules.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 25 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
4 references tracked. Mallory keeps watching after this page renders.
elastic.co
Open sourceelastic.co
Open sourceelastic.co
Open sourcelearn.microsoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Elastic Security Labs reported an intrusion at a South Asian financial institution involving two custom malware families: **BRUSHWORM**, a modular backdoor deployed as `paint.exe`, and **BRUSHLOGGER**, a keylogger masquerading as `libcurl.dll`. BRUSHWORM established persistence through scheduled tasks, contacted a command-and-control server, downloaded additional DLL payloads, and stole files including documents, spreadsheets, email archives, and source code. The malware also spread through removable media, giving the operator a way to move data and malware across disconnected environments. BRUSHLOGGER was delivered through **DLL side-loading** and used a low-level keyboard hook to capture system-wide keystrokes along with active window context, storing XOR-obfuscated logs under `C:\programdata\Photoes\`. Elastic said the tooling showed relatively low sophistication, with basic anti-analysis checks and an AES-CBC encrypted configuration using a hardcoded key, but still provided a functional collection platform for persistence, credential and data theft, USB propagation, and air-gap bridging. Earlier samples such as `V1.exe`, `V2.exe`, and `V4.exe` found on VirusTotal suggested the malware had been iteratively developed by the threat actor.
Jun 29, 2026
China-aligned threat group **Webworm** has expanded its espionage toolkit with two custom backdoors, **GraphWorm** and **EchoCreep**, using trusted cloud and social platforms for command-and-control. Researchers said **GraphWorm** is a Go-based implant that abuses **Microsoft OneDrive** through the **Microsoft Graph API**, creating a separate workspace for each victim and using cloud folders for tasking, file transfer, shell command execution, configurable sleep intervals, and data exfiltration. **EchoCreep** was observed using **Discord** for C2, while the group also staged malware and supporting tools from a GitHub repository masquerading as a WordPress fork. The activity reflects a broader shift by Webworm away from older RATs such as **Trochilus** and **9002 RAT** toward stealthier proxy and tunneling infrastructure, including **SoftEther VPN**, **WormFrp**, **ChainWorm**, **SmuxProxy**, and **WormSocket**. Victims span government and enterprise organizations across Asia and Europe, including entities in **Belgium, Italy, Serbia, Poland, and Spain**, as well as a university in **South Africa**; researchers also linked a compromised **Amazon S3** bucket to proxy configuration storage and exfiltrated data, including VM snapshots and government documents. Investigators observed the group using tools such as **Nuclei** and **dirsearch**, along with a script exploiting a known post-authentication RCE flaw in **SquirrelMail**, indicating active targeting of exposed web applications for initial access.
Jun 29, 2026
Researchers detailed two XWorm delivery operations that relied on multi-stage loaders, in-memory execution, and **AMSI bypasses** to evade detection. In one campaign attributed to **TAG-124**, compromised legitimate websites redirected selected victims into a PowerShell chain that patched `clr.dll` to disable `AmsiScanBuffer`, suppressed PowerShell history, disabled ETW, fingerprinted hosts, and pulled an XOR-encrypted payload from `sellmeyourbiz[.]com`, ultimately delivering **XWorm RAT**. Breakglass reported low initial detection rates and observed victim-specific beaconing under `/customers/`, with encoded host details including hostname, domain, username, process ID, campaign ID, and hardware UUID. A separate three-stage intrusion used a VBScript lure, `Projet20Immobilier.vbs`, masquerading as a French real-estate document to deploy **XWorm V5.6** through a .NET loader and process injection into `InstallUtil.exe`. Breakglass assessed the operator was likely Brazilian based on Portuguese-language code artifacts and found the same infrastructure also hosted a Portuguese carding marketplace, **Iluminat Store infosCC**, suggesting a vertically integrated criminal pipeline that steals credentials and payment data with XWorm and monetizes them directly through fraud services. The malware infrastructure included servers on DigitalOcean and Contabo, and the sample used the default XWorm encryption key `<123456789>`, exposing weak operator OPSEC despite capabilities that included keylogging, screenshot capture, DNS hijacking, persistence, and ransomware plugin support.
Jun 29, 2026