Zscaler Details APT37’s Ruby Jumper Campaign Targeting Air-Gapped Systems
Summary
Zscaler reports that APT37’s Ruby Jumper campaign uses new malware to target air-gapped systems. ThumbsBD and VirusTask use removable drives to exfiltrate data and spread malware, while FootWine provides Android surveillance capabilities.
Key points
- Zscaler says the campaign, named Ruby Jumper and discovered in December 2025, uses five new malicious tools.
- LNK files launch PowerShell and payloads including RestLeaf, which uses Zoho WorkDrive for command-and-control and attempts to retrieve shellcode.
- SnakeDropper establishes persistence by backdooring a Ruby interpreter and scheduling it to run every five minutes.
- ThumbsBD uses removable drives as bidirectional relays to move commands and exfiltrate data from air-gapped systems.
- VirusTask spreads through USB drives by replacing files with LNK shortcuts that launch shellcode when opened.
- Zscaler also observed ThumbsBD deploying FootWine, an Android package with keystroke logging and audio and video capture capabilities.
Article Details
- Attack Vectors
- APT37 used LNK files to execute a PowerShell script and deploy payloads.
- VirusTask propagated through removable drives by replacing files with LNK files that execute shellcode when opened.
- ThumbsBD used removable drives as bidirectional relays to move commands and exfiltrate data from air-gapped systems.
- RestLeaf used Zoho WorkDrive for command-and-control and to fetch a file containing shellcode.
- Defensive Notes
- Monitor endpoint activity and physical access points to help counter attacks using removable media against air-gapped systems.
MITRE ATT&CK
T1052.001 · Exfiltration over USBThumbsBD used removable drives as bidirectional relays for data exfiltration from air-gapped systems.T1053.005 · Scheduled TaskThe malware created a scheduled task to execute the backdoored Ruby interpreter every five minutes.T1056.001 · KeyloggingFootWine included keystroke-logging surveillance capabilities.T1059.001 · PowerShellAPT37 used a PowerShell script launched through LNK files to deploy payloads.T1082 · System Information DiscoveryThumbsBD collected system information from infected systems.T1091 · Replication Through Removable MediaVirusTask copied payload executables to removable drives and used them to spread malware to air-gapped systems.T1102.002 · Bidirectional CommunicationRestLeaf used Zoho WorkDrive for command-and-control and to fetch a shellcode-containing file.T1123 · Audio CaptureFootWine supported audio capture.T1125 · Video CaptureFootWine supported video capture.T1204.002 · Malicious FileVirusTask replaced files on removable drives with LNK files that execute shellcode when opened by a user.
Threat Actors
APT37Reportedly used multiple malicious tools in the Ruby Jumper campaign targeting air-gapped systems. The article identifies ScarCruft, Ruby Sleet, and Velvet Chollima as alternate names for APT37.KimsukyIdentified by the article as an alternate name for APT37, which was reported to use multiple malicious tools against air-gapped systems in the Ruby Jumper campaign.
Malware
FOOTWINEThe security firm also observed ThumbsBD deploying FootWine, an encrypted Android package file containing a shellcode launcher with surveillance capabilities, such as keystroke logging and audio and video capturing.RESTLEAFDubbed RestLeaf, it uses the Zoho WorkDrive cloud storage for command-and-control (C&C) and attempts to fetch a file containing shellcode from it.SNAKEDROPPERThe shellcode, which is executed in memory, acts as a launcher, fetching and decrypting second-stage shellcode that loads an embedded Windows executable, dubbed SnakeDropper.THUMBSBDExecuted every time the Ruby interpreter starts, SnakeDropper drops ThumbsBD, a backdoor that uses removable drives to exfiltrate data from air-gapped systems, using them as bidirectional relays.VIRUSTASKSnakeDropper was also observed dropping VirusTask, a removable media propagation tool designed to infect air-gapped systems, which exclusively weaponizes USB drives for initial access.
Vendors
Products
AndroidThe security firm also observed ThumbsBD deploying FootWine, an encrypted Android package file containing a shellcode launcher with surveillance capabilities, such as keystroke logging and audio and video capturing.Microsoft WindowsThe shellcode, which is executed in memory, acts as a launcher, fetching and decrypting second-stage shellcode that loads an embedded Windows executable, dubbed SnakeDropper.Ruby 3.3.0The malware creates a working directory and installs the Ruby 3.3.0 runtime environment disguised as a USB speed monitoring utility, backdoors the Ruby interpreter, and creates a scheduled task to execute theZoho WorkDriveDubbed RestLeaf, it uses the Zoho WorkDrive cloud storage for command-and-control (C&C) and attempts to fetch a file containing shellcode from it.
Countries
North KoreaA North Korea-linked threat actor tracked as APT37 has been observed using five new malicious tools in a recent campaign targeting air-gapped systems, Zscaler reports.South KoreaAlso tracked as ScarCruft, Ruby Sleet, and Velvet Chollima, APT37 has been active since 2012, focusing on data theft and surveillance and mainly targeting entities in South Korea.