cyber.hendryadrian.com
Threat Research · bleepingcomputer.com

APT37’s Ruby Jumper Campaign Uses USB Malware to Bridge Air-Gapped Networks

· Original article ↗

Summary

Zscaler researchers link APT37’s Ruby Jumper campaign to a five-tool toolkit that uses LNK/PowerShell, Zoho WorkDrive C2, and removable drives to relay commands and data across air-gapped systems and support surveillance.

Key points

  • Zscaler identified RESTLEAF, SNAKEDROPPER, THUMBSBD, VIRUSTASK, and FOOTWINE in the campaign, which researchers attribute to APT37 with high confidence.
  • The infection chain starts with a malicious LNK file that runs PowerShell, extracts payloads, and opens a decoy document.
  • RESTLEAF uses Zoho WorkDrive for command-and-control and fetches encrypted shellcode that delivers the Ruby-based SNAKEDROPPER loader.
  • SNAKEDROPPER installs a disguised Ruby 3.3.0 runtime and modifies a RubyGems file to load malicious code through a scheduled task.
  • THUMBSBD creates hidden directories on USB drives to stage files, relay commands to air-gapped systems, and support data exfiltration.
  • VIRUSTASK spreads the infection through removable drives by replacing legitimate files with malicious shortcuts; it requires at least 2 GB of free space to trigger infection.
  • FOOTWINE is described as a spyware backdoor with keylogging, recording, file manipulation, and remote-shell capabilities; no specific victims were identified.

Article Details

Attack Vectors
  • A victim opening a malicious Windows LNK file triggers a PowerShell script that extracts embedded payloads and opens a decoy document.
  • RESTLEAF uses Zoho WorkDrive for C2 communication and to retrieve encrypted shellcode that delivers the SNAKEDROPPER loader.
  • SNAKEDROPPER installs a concealed Ruby 3.3.0 runtime and uses a scheduled task to execute a maliciously modified RubyGems file.
  • THUMBSBD creates hidden directories on detected USB drives, stages files, and uses removable media as a bidirectional covert C2 relay for air-gapped systems.
  • VIRUSTASK spreads infection through removable drives by hiding legitimate files and replacing them with malicious shortcuts; it triggers only when the drive has at least 2 GB of free space.
  • THUMBSBD delivers FOOTWINE, which the article describes as a Windows spyware backdoor disguised as an Android package file.

MITRE ATT&CK

T1036.005 · Match Legitimate Resource Name or LocationThe Ruby runtime is disguised as a legitimate USB-related utility named usbspeed.exe.T1052.001 · Exfiltration over USBTHUMBSBD uses USB drives to stage files and transfer data out of air-gapped systems.T1053.005 · Scheduled TaskA scheduled task named rubyupdatecheck executes every five minutes to start the modified RubyGems file.T1056.001 · KeyloggingFOOTWINE supports keylogging.T1059.001 · PowerShellThe LNK deploys a PowerShell script that extracts embedded payloads and launches a decoy document.T1082 · System Information DiscoveryTHUMBSBD collects system information.T1091 · Replication Through Removable MediaVIRUSTASK spreads infection to new air-gapped machines through removable drives and malicious shortcuts.T1102.002 · Bidirectional CommunicationRESTLEAF communicates with C2 using Zoho WorkDrive.T1105 · Ingress Tool TransferRESTLEAF fetches encrypted shellcode from C2 to deliver the SNAKEDROPPER loader.T1113 · Screen CaptureFOOTWINE supports screenshot capture.T1123 · Audio CaptureFOOTWINE supports audio recording.T1125 · Video CaptureFOOTWINE supports video recording.T1204.002 · Malicious FileThe infection chain starts when a victim opens a malicious Windows LNK file.T1564.001 · Hidden Files and DirectoriesTHUMBSBD creates hidden directories on detected USB drives.

Threat Actors

APT37The Ruby Jumper campaign is attributed to APT37; Zscaler reports high confidence based on the malware, LNK delivery, shellcode delivery technique, and C2 infrastructure.InkySquidThe article identifies InkySquid as another name for APT37, which it attributes to the Ruby Jumper campaign.Ricochet ChollimaThe article identifies Ricochet Chollima as another name for APT37, which it attributes to the Ruby Jumper campaign.

Malware

BLUELIGHTAnother piece of malware also observed in the APT37’s RubyJumper campaign is BLUELIGHT, a full-fledged backdoor previously associated with the North Korean threat group.FOOTWINEResearchers at Zscaler identified a five-tool toolkit — RESTLEAF, SNAKEDROPPER, THUMBSBD, VIRUSTASK, and FOOTWINE — that leverages LNK/PowerShell chains, Zoho WorkDrive C2, and a hidden Ruby runtime to persist andRESTLEAFResearchers at Zscaler identified a five-tool toolkit — RESTLEAF, SNAKEDROPPER, THUMBSBD, VIRUSTASK, and FOOTWINE — that leverages LNK/PowerShell chains, Zoho WorkDrive C2, and a hidden Ruby runtime to persist andSNAKEDROPPERResearchers at Zscaler identified a five-tool toolkit — RESTLEAF, SNAKEDROPPER, THUMBSBD, VIRUSTASK, and FOOTWINE — that leverages LNK/PowerShell chains, Zoho WorkDrive C2, and a hidden Ruby runtime to persist andTHUMBSBDResearchers at Zscaler identified a five-tool toolkit — RESTLEAF, SNAKEDROPPER, THUMBSBD, VIRUSTASK, and FOOTWINE — that leverages LNK/PowerShell chains, Zoho WorkDrive C2, and a hidden Ruby runtime to persist andVIRUSTASKResearchers at Zscaler identified a five-tool toolkit — RESTLEAF, SNAKEDROPPER, THUMBSBD, VIRUSTASK, and FOOTWINE — that leverages LNK/PowerShell chains, Zoho WorkDrive C2, and a hidden Ruby runtime to persist and

Products

RubyNorth Korean state-backed group APT37 is running a campaign called Ruby Jumper that uses removable drives to bridge air-gapped systems for data exfiltration and covert surveillance.Zoho WorkDrive— RESTLEAF, SNAKEDROPPER, THUMBSBD, VIRUSTASK, and FOOTWINE — that leverages LNK/PowerShell chains, Zoho WorkDrive C2, and a hidden Ruby runtime to persist and spread.

Related Articles