Back Gbhackers

Hackers Target South Asian Financial Firm with BRUSHWORM and BRUSHLOGGER Attacks

Gbhackers •Mayura Kathir • March 27, 2026

A South Asian financial institution has been hit by a custom malware toolkit combining a modular backdoor, dubbed BRUSHWORM, and a DLL side‑loaded keylogger known as BRUSHLOGGER. The attackers relied on a backdoor initially named paint.exe and a keylogger masquerading as libcurl.dll, both of which lacked advanced packing or obfuscation. BRUSHWORM acts as the primary implant, handling […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Cyberattack on South Asian Financial Firm Using BRUSHWORM and BRUSHLOGGER Malware A South Asian financial institution has been targeted by a cyberattack utilizing two custom malware tools: BRUSHWORM, a modular backdoor, and BRUSHLOGGER, a keylogger disguised as a trusted system file. The attack involved file theft and real-time keystroke capture, indicating a sophisticated approach to data exfiltration. The malware was deployed through a backdoor named paint.exe and a keylogger masquerading as libcurl.dll, both of which did not employ advanced packing or obfuscation techniques. This incident highlights the increasing risks faced by financial organizations in the region. The specific impact on the institution's operations and data integrity remains unclear. As of now, there are no reports of a patch or mitigation strategy being implemented. The attack underscores the need for enhanced cybersecurity measures in the financial sector. 2 sources 49

Extracted Entities

Hackers Target South Asian Financial Firm with BRUSHWORM and BRUSHLOGGER Attacks

The full story

Extracted Entities

Attack Types (1)

Industries (1)

Malware (2)

MITRE ATT&CK (2)

Tools (2)