Executive Summary
Elastic Security Labs recently uncovered a targeted campaign against a South Asian financial institution involving two custom malware components: BRUSHWORM and BRUSHLOGGER. While the code exhibits low sophistication and lacks advanced obfuscation, the toolset is functional and capable of broad data theft, including documents, email archives, and source code. The presence of multiple iterative testing versions on VirusTotal suggests the threat actor is actively developing and refining their capabilities.
Technically, the attack chain utilizes DLL side-loading to deploy the keylogger (masquerading as libcurl.dll) and COM-based scheduled tasks for persistence. BRUSHWORM serves as the primary implant, performing environment checks for sandboxes, establishing a modular architecture for payload delivery, and implementing a USB-based propagation mechanism. This mechanism serves a dual purpose: spreading the infection and acting as an exfiltration bridge for air-gapped systems by copying stolen data back to removable media.
This threat is significant due to its specialized focus on financial sector data and its ability to bypass network restrictions via physical media. The use of lure filenames like 'Salary Slips.exe' and 'Important.exe' highlights a social engineering component designed to exploit corporate workflows.