Back Cybersecuritynews

Hackers Deploy BRUSHWORM and BRUSHLOGGER Against South Asian Financial Firm

Cybersecuritynews •Tushar Subhra Dutta • March 27, 2026

A South Asian financial institution has become the latest target of a focused cyberattack involving two custom-built malware tools — BRUSHWORM, a modular backdoor, and BRUSHLOGGER, a keylogger disguised as a trusted system file. The attack combined file theft, persistent system access, and real-time keystroke capture, underlining the growing risk that financial organizations across South […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Cyberattack on South Asian Financial Firm Using BRUSHWORM and BRUSHLOGGER Malware A South Asian financial institution has been targeted by a cyberattack utilizing two custom malware tools: BRUSHWORM, a modular backdoor, and BRUSHLOGGER, a keylogger disguised as a trusted system file. The attack involved file theft and real-time keystroke capture, indicating a sophisticated approach to data exfiltration. The malware was deployed through a backdoor named paint.exe and a keylogger masquerading as libcurl.dll, both of which did not employ advanced packing or obfuscation techniques. This incident highlights the increasing risks faced by financial organizations in the region. The specific impact on the institution's operations and data integrity remains unclear. As of now, there are no reports of a patch or mitigation strategy being implemented. The attack underscores the need for enhanced cybersecurity measures in the financial sector. 2 sources 49

Extracted Entities

Hackers Deploy BRUSHWORM and BRUSHLOGGER Against South Asian Financial Firm

The full story

Extracted Entities

Attack Types (1)

Industries (1)

Malware (2)

MITRE ATT&CK (1)