Malware
Broomstick
aka CLEANBOOST · CleanUp · CleanUpLoader · Oyster
Oyster is a backdoor malware written in C++ that first appeared in July 2023.
Broomstick, also known as CLEANBOOST, CleanUp, CleanUpLoader, Oyster, is a Windows malware family.
Background
Oyster is a C++ backdoor that surfaced in July 2023. It enables remote sessions and handles tasks such as file transfer and command-line processing. A range of threat actors have leveraged it to support ransomware intrusions, and the build identifiers seen across analyzed samples suggest it has been distributed through several methods. Oyster also gathers basic system data, communicates with a command-and-control (C2) server, executes commands through cmd.exe, and runs additional files.
A new version of Oyster appeared in August 2024 that introduced a revised command-and-control (C2) protocol format; this 2024 build included plaintext strings and no code obfuscation, indicating it was still under development. By contrast, the 2025 release of Oyster no longer transmits C2 messages in plaintext and instead brings back the substitution cipher used in earlier versions.
Source: Malpedia (Fraunhofer FKIE).