MalwarePublished 27 Mar 2026

BRUSHWORM and BRUSHLOGGER uncovered

Source AlienVault OTX General

Description

A South Asian financial institution was targeted with two custom malware components: BRUSHWORM, a modular backdoor, and BRUSHLOGGER, a keylogger. BRUSHWORM features anti-analysis checks, encrypted configuration, scheduled task persistence, modular payload downloading, USB worm propagation, and extensive file theft. BRUSHLOGGER uses DLL side-loading to capture system-wide keystrokes with window context tracking. The malware's low sophistication and implementation flaws suggest an inexperienced author, possibly using AI code-generation tools. Multiple testing versions were discovered on VirusTotal, indicating iterative development. The malware components combine to create a functional collection platform with modular loading, USB propagation, broad file theft, air-gap bridging, and persistent keystroke capture.

Impact

Organizations targeted by BRUSHWORM and BRUSHLOGGER face significant risks to the confidentiality and integrity of sensitive data, particularly financial information. The malware’s ability to steal extensive files and capture keystrokes system-wide can lead to credential theft, unauthorized access, and financial fraud. USB worm propagation and air-gap bridging capabilities increase the risk of lateral movement and infection of isolated networks, which are typically considered highly secure. The persistence mechanisms and anti-analysis features complicate detection and removal, potentially allowing long-term espionage and data exfiltration. For financial institutions, this could result in severe financial losses, reputational damage, regulatory penalties, and erosion of customer trust. The malware’s low sophistication suggests that similar threats could proliferate easily, increasing the overall threat landscape for organizations with similar profiles worldwide.

Defensive guidance

1. Implement strict controls on USB device usage, including disabling autorun features and restricting USB ports to authorized devices only. 2. Deploy endpoint detection and response (EDR) solutions capable of detecting DLL side-loading and unusual scheduled task creations. 3. Monitor network traffic for signs of modular payload downloads and suspicious connections to known malicious URLs such as 'http://resources.dawnnewsisl.com/updtdll'. 4. Use behavioral analytics to detect keylogging activities and anomalous file access patterns indicative of extensive data theft. 5. Conduct regular threat hunting exercises focusing on the identified malware hashes and YARA rules provided. 6. Harden systems by applying the principle of least privilege to limit malware’s ability to persist and propagate. 7. Educate employees on the risks of using untrusted USB devices and phishing attempts that may deliver initial infection vectors. 8. Maintain up-to-date backups isolated from the network to recover from potential data loss or ransomware attacks that could follow such infections. 9. Employ application whitelisting to prevent unauthorized DLLs from loading and restrict execution of unknown binaries. 10. Collaborate with threat intelligence providers to stay informed about emerging variants and indicators of compromise related to BRUSHWORM and BRUSHLOGGER.

Indicators of compromise

URLs 1

http://resources.dawnnewsisl.com/updtdll

Hashes 4

4f1ea5ed6035e7c951e688bd9c2ec47a1e184a81e9ae783d4a0979501a1985cf
89891aa3867c1a57512d77e8e248d4a35dd32e99dcda0344a633be402df4a9a7
30896513cb0aefc78d0343e76d82b49f4afacf21
da2e41f026d2cca001ed584cd22cf4e5e02a8c8f

Yara 2

30896513cb0aefc78d0343e76d82b49f4afacf21
da2e41f026d2cca001ed584cd22cf4e5e02a8c8f

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 27 Mar 2026, 09:59 UTC

MITRE ATT&CK techniques13 from threat tags

Technical details

Indicators of compromise

URLs 1

Hashes 4

Yara 2

Community reviews

Related threats