APT37’s Ruby Jumper Campaign Uses USB Media to Reach Air-Gapped Networks
Summary
Zscaler ThreatLabz documented APT37’s Ruby Jumper campaign, which uses malicious LNK files and USB-propagated tools to reach air-gapped systems and stage data for delayed exfiltration.
Key points
- The campaign was discovered by Zscaler ThreatLabz in December 2025 and uses malicious LNK files to launch PowerShell and extract embedded payloads.
- Restleaf profiles hosts, establishes persistence, and uses Zoho WorkDrive for command-and-control and to retrieve additional components.
- SnakeDropper decrypts and deploys modules in memory, reducing on-disk artifacts.
- ThumbSBD copies tailored infection packages to USB drives and uses shortcut files to resume infection on other systems, including air-gapped machines.
- VirusTask collects system information and stages data for exfiltration via removable media; FootWine harvests documents and monitors removable-drive activity.
- The previously documented BlueLight tool supports command execution and data staging for delayed exfiltration.
Article Details
- Attack Vectors
- A malicious LNK file launches PowerShell, which locates the file and extracts embedded payloads from fixed offsets.
- ThumbSBD copies an infection package to connected USB drives and uses shortcut files to trigger execution on another system, including air-gapped machines.
- Restleaf uses Zoho WorkDrive for command-and-control and to retrieve follow-on components.
- SnakeDropper decrypts and deploys additional modules in memory.
- Stolen data is staged on removable media in hidden or obfuscated form for delayed exfiltration.
MITRE ATT&CK
T1005 · Data from Local SystemFootWine harvests documents from compromised systems.T1052.001 · Exfiltration over USBThe operators use removable media to carry stolen data out of air-gapped environments.T1059.001 · PowerShellThe LNK file launches a PowerShell command to locate itself and extract embedded payloads.T1074.001 · Local Data StagingVirusTask stages data for exfiltration, and BlueLight stages data for delayed exfiltration via USB.T1082 · System Information DiscoveryVirusTask collects system information from infected systems.T1091 · Replication Through Removable MediaThumbSBD copies an infection package to USB drives and uses shortcut files to propagate to other systems.T1102.002 · Bidirectional CommunicationRestleaf uses Zoho WorkDrive for command-and-control communications.T1105 · Ingress Tool TransferRestleaf retrieves follow-on components from Zoho WorkDrive.T1140 · Deobfuscate/Decode Files or InformationSnakeDropper decrypts additional modules before deploying them.T1204.002 · Malicious FileThe campaign uses malicious LNK files that execute when a victim opens them.
Threat Actors
APT37The article attributes the Ruby Jumper campaign, including USB propagation and air-gapped system targeting, to APT37.InkySquidThe article lists InkySquid as another name for APT37, which it attributes to the Ruby Jumper campaign.KimsukyThe article lists Ruby Sleet as another name for APT37, which it attributes to the Ruby Jumper campaign.Ricochet ChollimaThe article lists Ricochet Chollima as another name for APT37, which it attributes to the Ruby Jumper campaign.
Malware
RESTLEAFThe operation leverages newly documented tools — including Restleaf, SnakeDropper, ThumbSBD, VirusTask and FootWine — with Restleaf using Zoho WorkDrive for C2 and ThumbSBD enabling USB propagation for delayedSNAKEDROPPERThe operation leverages newly documented tools — including Restleaf, SnakeDropper, ThumbSBD, VirusTask and FootWine — with Restleaf using Zoho WorkDrive for C2 and ThumbSBD enabling USB propagation for delayedVIRUSTASKThe operation leverages newly documented tools — including Restleaf, SnakeDropper, ThumbSBD, VirusTask and FootWine — with Restleaf using Zoho WorkDrive for C2 and ThumbSBD enabling USB propagation for delayed
Vendors
Products
PowerShellAPT37’s “Ruby Jumper” campaign was discovered by Zscaler ThreatLabz and uses malicious LNK files that invoke PowerShell to extract embedded payloads.Zoho WorkDrivetools — including Restleaf, SnakeDropper, ThumbSBD, VirusTask and FootWine — with Restleaf using Zoho WorkDrive for C2 and ThumbSBD enabling USB propagation for delayed exfiltration.
Tools
BlueLightSnakeDropper deploys modules in memory to minimize disk artefacts and BlueLight is used for command execution and staging exfiltration via removable media.FootWineoperation leverages newly documented tools — including Restleaf, SnakeDropper, ThumbSBD, VirusTask and FootWine — with Restleaf using Zoho WorkDrive for C2 and ThumbSBD enabling USB propagation for delayedRestleafThe operation leverages newly documented tools — including Restleaf, SnakeDropper, ThumbSBD, VirusTask and FootWine — with Restleaf using Zoho WorkDrive for C2 and ThumbSBD enabling USB propagation for delayedSnakeDropperThe operation leverages newly documented tools — including Restleaf, SnakeDropper, ThumbSBD, VirusTask and FootWine — with Restleaf using Zoho WorkDrive for C2 and ThumbSBD enabling USB propagation for delayedThumbSBDThe operation leverages newly documented tools — including Restleaf, SnakeDropper, ThumbSBD, VirusTask and FootWine — with Restleaf using Zoho WorkDrive for C2 and ThumbSBD enabling USB propagation for delayedVirusTaskThe operation leverages newly documented tools — including Restleaf, SnakeDropper, ThumbSBD, VirusTask and FootWine — with Restleaf using Zoho WorkDrive for C2 and ThumbSBD enabling USB propagation for delayed
Countries
Japanon the public and private sectors in South Korea, the group expanded its operations in 2017 to include Japan, Vietnam and the Middle East, and to a wider range of industry verticals, including chemicals,North KoreaA North Korea–linked group, APT37, has deployed a new “Ruby Jumper” campaign that uses malicious LNK files and a suite of implants to infect systems and bridge air-gapped networks via removable USB media.South KoreaInitially focused on the public and private sectors in South Korea, the group expanded its operations in 2017 to include Japan, Vietnam and the Middle East, and to a wider range of industry verticals, includingVietnampublic and private sectors in South Korea, the group expanded its operations in 2017 to include Japan, Vietnam and the Middle East, and to a wider range of industry verticals, including chemicals, electronics,
Industries
AerospaceEast, and to a wider range of industry verticals, including chemicals, electronics, manufacturing, aerospace, automotive and healthcare entities.Automotiveand to a wider range of industry verticals, including chemicals, electronics, manufacturing, aerospace, automotive and healthcare entities.Chemicalsto include Japan, Vietnam and the Middle East, and to a wider range of industry verticals, including chemicals, electronics, manufacturing, aerospace, automotive and healthcare entities.ElectronicsJapan, Vietnam and the Middle East, and to a wider range of industry verticals, including chemicals, electronics, manufacturing, aerospace, automotive and healthcare entities.Healthcarerange of industry verticals, including chemicals, electronics, manufacturing, aerospace, automotive and healthcare entities.Manufacturingand the Middle East, and to a wider range of industry verticals, including chemicals, electronics, manufacturing, aerospace, automotive and healthcare entities.