Malware Targets Financial Institutions With Brushworm And Brushlogger
A targeted cyberattack against a South Asian financial institution leveraged two custom malware tools to establish persistence, steal sensitive data, and capture user activity. Researchers said the operation relied on a modular backdoor, BRUSHWORM, and a keylogger, BRUSHLOGGER, delivered as separate binaries to improve flexibility and stealth.
BRUSHWORM, disguised as a legitimate executable, served as the primary foothold. It established persistence by creating scheduled tasks that executed at user logon, enabling continuous access to the infected system. The malware communicated with a remote command-and-control server to download additional payloads and exfiltrate sensitive documents. It also propagated via USB drives using deceptive filenames tailored to corporate environments, increasing the likelihood of user execution and lateral spread.
BRUSHLOGGER operated through DLL side-loading by masquerading as a trusted system library. Once loaded, it silently recorded keystrokes and active window titles, allowing attackers to capture credentials, financial data, and internal communications in real time.
The attack highlighted weaknesses in visibility, as the victim environment relied primarily on SIEM logs, limiting post-compromise investigation. Researchers noted that despite its impact, the malware lacked advanced obfuscation and demonstrated poor coding practices, suggesting a relatively inexperienced threat actor. Earlier development samples indicated iterative improvements before deployment.
Overall, the campaign combined persistence mechanisms, credential harvesting, and removable media propagation, demonstrating how even low-complexity malware can achieve significant impact when paired with social engineering and limited endpoint visibility.
Attack Surface
Endpoint, File Storage, Endpoint OS
Tactics
Initial Access, Execution, Persistence, Exfiltration, Defense Evasion, Discovery, Credential Access, Command and Control, Lateral Movement
Techniques
- T1190 – Spearphishing via Service
- T1204 – User Execution
- T1055 – Scheduled Task
- T1053.005 – Scheduled Task/Job: Scheduled Task
- T1574.002 – Hijack Execution Flow: DLL Side-Loading
- T1091 – Replication Through Removable Media
- T1056.001 – Input Capture: Keylogging
- T1036.005 – Masquerading: Match Legitimate Name or Location
- T1560 – Archive Collected Data
- T1105 – Ingress Tool Transfer
- T1041 – Exfiltration Over C2 Channel
SuperPRO's Threat Countermeasures Procedures
- Implement strict application whitelisting to prevent the execution of unsigned or unauthorized binaries
- Configure endpoint monitoring to alert on the creation of unusual scheduled tasks particularly those involving system utilities like rundll32.exe
- Disable or strictly control the use of removable USB media to block physical malware propagation and data exfiltration
- Deploy Endpoint Detection and Response tools capable of identifying DLL side-loading and suspicious library loading behaviors
- Conduct regular audits of hidden system directories and ProgramData folders for unauthorized executable files
- Enhance logging and telemetry beyond the SIEM level to provide better visibility into post-exploitation activities