Inside the BRUSHWORM Malware Campaign Bridging Air-Gaps with USB “Sleeper” Cells

Elastic Security Labs identified a targeted campaign against a South Asian financial institution using two custom tools: BRUSHWORM, a modular backdoor that persists via a scheduled task and propagates to USB drives for offline exfiltration, and BRUSHLOGGER, a libcurl.dll‑masquerading keylogger that records window context and stores XOR-encrypted logs; despite coding flaws that suggest an inexperienced author, the campaign is operational and poses a significant data-theft risk.