Threat Profile
| Threat Name | Broomstick (Oyster, CLEANBOOST, CleanUpLoader) |
|---|---|
| Category | Backdoor / Remote Access Trojan |
| Platform | Windows (all modern versions) |
| File Type | Windows PE executable (compiled C++) |
| First Observed | July 2023 |
| Typical Distribution | Phishing attachments, compromised RDP, software supply-chain |
| Primary Purpose | Establish command-and-control connection for follow-on attacks |
| Common Follow-On Threats | Ransomware families (LockBit, BlackCat, ALPHV variants) |
| Detection Aliases | Trojan.Win32.Broomstick, Backdoor:Win32/Oyster, HEUR:Trojan.Win32.Generic |
| Persistence Mechanisms | Registry Run keys, scheduled tasks, Windows services |
| Skill Level Required | Advanced (typically deployed by organized threat groups) |
| Intelligence Last Updated | September 2026 (Malpedia) |
How It Spreads
Broomstick arrives on victim systems through multiple attack vectors, often customized for the target environment. The presence of distinct build identifiers in analyzed samples suggests that different threat groups have adapted the malware for their specific campaigns. Unlike mass-distributed malware, Broomstick infections typically represent deliberate targeting—someone has selected your organization or machine as a worthwhile objective. The most common entry points involve social engineering and credential compromise. Attackers may send phishing emails with weaponized Office documents or PDF files that exploit known vulnerabilities, ultimately downloading and executing the Broomstick payload. In other cases, threat actors gain initial access through compromised Remote Desktop Protocol (RDP) connections, using stolen or brute-forced credentials to manually install the backdoor on target systems. Distribution methods documented by security researchers include: - Spear-phishing emails with malicious attachments masquerading as invoices, shipping notifications, or business documents - Compromised RDP servers with weak passwords or unpatched vulnerabilities - Software supply-chain attacks where legitimate installers are trojanized with Broomstick - Drive-by downloads from compromised legitimate websites - Lateral movement from already-infected machines on the same network - Exploitation of unpatched VPN appliances and network edge devicesWhat It Does On Your Machine
Once executed, Broomstick performs initial reconnaissance to understand the environment it's operating in. The malware collects basic system information including computer name, operating system version, installed software, domain membership, and user privileges. This data is packaged and transmitted to the attacker's command-and-control server, allowing them to assess whether the compromised system is valuable enough for further exploitation. The backdoor establishes persistent communication channels with its C2 infrastructure, checking in at regular intervals for commands. Broomstick supports interactive remote sessions where operators can navigate the file system, upload and download files, and execute arbitrary commands through cmd.exe. This flexibility makes it an ideal staging platform for ransomware—attackers use Broomstick to map the network, identify valuable targets, and position ransomware payloads before triggering encryption across the environment. File transfer capabilities allow attackers to retrieve sensitive documents, credentials, and intellectual property before deploying ransomware. This "double extortion" approach has become standard in modern ransomware operations: steal your data first, encrypt it second, then threaten to publish what was stolen if you don't pay. Broomstick is often the tool that enables the theft phase.Manual Removal — Step by Step
Isolate the Infected System
Immediately disconnect the computer from all networks—unplug the Ethernet cable and disable Wi-Fi. Do not shut down the machine yet, as memory-resident evidence may be lost. If this is a business environment, notify your IT department or security team before proceeding. Broomstick infections often indicate broader network compromise.
Boot Into Safe Mode With Networking
Restart the computer and press F8 repeatedly during boot (or use Shift+Restart on Windows 10/11 to access recovery options). Select "Safe Mode with Networking" from the advanced boot menu. This prevents most malware from loading automatically while still allowing you to download security tools.
Run a Full Antivirus Scan
Update your antivirus software to the latest definitions and perform a complete system scan. Because Broomstick is known to security vendors, current antivirus should detect it under one of its aliases (Oyster, CLEANBOOST, CleanUpLoader). Allow the scan to complete even if it takes several hours. Quarantine all detected threats.
Check Startup Locations Manually
Open the Run dialog (Windows+R), type msconfig, and examine the Startup tab. Look for unfamiliar entries, especially those pointing to AppData folders or temporary directories. Also type regedit and navigate to HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run and the corresponding HKEY_LOCAL_MACHINE location. Delete suspicious entries, but photograph them first for documentation.
Review Scheduled Tasks and Services
Type taskschd.msc in the Run dialog to open Task Scheduler. Examine the Task Scheduler Library for recently created tasks with generic names like "SystemUpdate" or "Maintenance." Delete suspicious tasks. Then type services.msc and review the services list for unfamiliar entries, especially those set to Automatic startup with executable paths in user directories.
Scan With Secondary Tools
Download and run Malwarebytes and HitmanPro (if possible, download these on a clean computer and transfer via USB). These tools use different detection engines and may catch components that your primary antivirus missed. Broomstick operators often deploy multiple persistence mechanisms, so redundant scanning is critical.
Examine Recent File Modifications
In File Explorer, sort your AppData folders (Local, Roaming, and LocalLow) by date modified. Look for executable files created around the time infection symptoms appeared. Also check C:\Users\Public, C:\ProgramData, and C:\Windows\Temp. Document any suspicious files before deleting them—you may need this information for forensic analysis.
Change All Passwords From a Clean Device
Do not change passwords from the infected machine. Use a different computer or your smartphone to change passwords for all accounts accessed from the compromised system—especially email, banking, work credentials, and cloud storage. Enable two-factor authentication wherever possible. Broomstick's command-and-control capabilities may have allowed attackers to capture credentials.
Monitor for Reinfection Signs
After removal, watch for suspicious behavior over the next week: unexpected network activity, files appearing in temp folders, unfamiliar processes, or performance degradation. Run daily quick scans. If you're part of a business network, coordinate with IT to monitor for lateral movement attempts—your infection may be one of many.
Consider Professional Forensic Analysis
For business systems or cases where sensitive data may have been accessed, manual removal may not be sufficient. Broomstick is frequently used in targeted attacks, and its presence suggests skilled adversaries. Professional forensic analysis can determine what data was accessed, whether the threat has spread, and what legal or compliance obligations may exist. Computer Repair Roswell provides forensic imaging and analysis services for these scenarios.
Prevention
- Implement network segmentation. Separate critical systems from general user workstations. If Broomstick infects one segment, proper network architecture prevents automatic lateral movement to valuable targets like file servers, databases, or backup systems.
- Enforce strong RDP security. Disable Remote Desktop Protocol entirely if it's not required. If RDP is necessary, place it behind a VPN, use complex passwords, enable Network Level Authentication, and implement account lockout policies to thwart brute-force attacks—a common Broomstick entry point.
- Maintain aggressive patching schedules. Broomstick operators often exploit known vulnerabilities in operating systems, browsers, and productivity software. Automated patch management ensures vulnerabilities are closed before attackers can weaponize them. Don't neglect firmware updates for routers, VPN appliances, and network-attached storage.
- Deploy endpoint detection and response (EDR) tools. Traditional antivirus catches known samples, but behavioral EDR solutions can detect the command-execution patterns and C2 communications that characterize Broomstick activity. These tools provide visibility that signature-based detection cannot.
- Train users to recognize phishing attempts. Conduct regular security awareness training with realistic phishing simulations. Broomstick often arrives via social engineering—employees who can identify suspicious attachments, urgent requests, and impersonation attempts become your first line of defense.
- Restrict user privileges. Standard user accounts cannot install system-level persistence mechanisms as easily as administrator accounts. Use the principle of least privilege: daily work should occur in standard accounts, with administrative access granted only when specifically needed for legitimate tasks.
- Maintain offline, encrypted backups. Since Broomstick frequently precedes ransomware, comprehensive backups are your ultimate insurance policy. Follow the 3-2-1 rule: three copies of data, two different media types, one copy offline. Test restoration procedures regularly—untested backups are wishful thinking, not disaster recovery.
- Monitor outbound network traffic. Implement DNS filtering and firewall rules that log outbound connections. Broomstick must communicate with C2 infrastructure, and these connections often exhibit patterns (regular beaconing intervals, connections to newly registered domains, unusual destination countries) that security teams can detect and investigate.