"Salary Slips.exe." "Dont Delete.exe." "Important.exe." These are the filenames BRUSHWORM copies...

Summary

Elastic Security Labs discovered BRUSHWORM, a malware campaign targeting a South Asian financial institution. The threat uses custom components that masquerade as legitimate files (Salary Slips.exe, Dont Delete.exe, Important.exe) when spreading across USB drives. The attack demonstrates a blend of social engineering and technical sophistication, combining multiple malicious components for network infiltration.

Indicators of Compromise

• malware — BRUSHWORM

Entities