APT37 Uses Ruby Jumper Malware to Bridge Air-Gapped Networks via Removable Media
Summary
ThreatLabz details APT37’s Ruby Jumper campaign, which uses malicious LNK files and a suite of tools to spread through removable media, relay commands and data across air-gapped systems, and deploy surveillance backdoors.
Key points
- The campaign, discovered by ThreatLabz in December 2025, is attributed to North Korean government-backed APT37.
- A malicious Windows shortcut launches PowerShell and stages RESTLEAF, which uses Zoho WorkDrive for command-and-control and payload delivery.
- SNAKEDROPPER installs a Ruby runtime, establishes persistence through a scheduled task, and drops additional malware.
- THUMBSBD uses removable media as a two-way relay for commands and data between connected and air-gapped systems.
- VIRUSTASK spreads to new systems by hiding files on removable media and replacing them with malicious shortcuts.
- The campaign can deliver FOOTWINE, which supports keylogging and audio/video capture, and the BLUELIGHT backdoor.
- ThreatLabz lists host and network indicators of compromise; Zscaler says its sandbox and security platform detect the campaign.
Article Details
- Attack Vectors
- A malicious LNK file launches PowerShell, which locates the LNK and carves embedded payloads from it.
- VIRUSTASK infects removable media by hiding original files and replacing them with same-named LNK shortcuts that execute the disguised Ruby interpreter on another system.
- THUMBSBD uses removable media to relay commands and collected data between internet-connected and air-gapped systems.
- Defensive Notes
- Monitor endpoint activity and physical access points to help counter removable-media propagation and transfers across air-gapped networks.
- Zscaler reports that its Cloud Sandbox and multilayered cloud security platform detect this campaign and related indicators.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | hightkdhe[.]store | THUMBSBD C2 domain; the article says it remained operational during the investigation. |
| DOMAIN | homeatedke[.]store | THUMBSBD C2 domain. |
| DOMAIN | philion[.]store | THUMBSBD C2 domain. |
| IPV4 | 144[.]172[.]106[.]66 | FOOTWINE C2 IP address; the article lists it with port 8080. |
| MD5 | 098d697f29b94c11b52c51bfe8f9c47d | MD5 hash listed for the shellcode plus SNAKEDROPPER binary. |
| MD5 | 4214818d7cde26ebeb4f35bc2fc29ada | MD5 hash listed for ascii.rb, identified as shellcode plus THUMBSBD. |
| MD5 | 476bce9b9a387c5f39461d781e7e22b9 | MD5 hash listed for foot.apk, identified as shellcode plus FOOTWINE. |
| MD5 | 585322a931a49f4e1d78fb0b3f3c6212 | MD5 hash listed for footaaa.apk, identified as shellcode plus BLUELIGHT. |
| MD5 | 5c6ff601ccc75e76c2fc99808d8cc9a9 | MD5 hash listed for bundler_index_client.rb, identified as shellcode plus VIRUSTASK. |
| MD5 | 709d70239f1e9441e8e21fcacfdc5d08 | MD5 hash listed for the campaign's Windows shortcut. |
| MD5 | ad556f4eb48e7dba6da14444dcce3170 | MD5 hash listed for viewer.dat, identified as shellcode plus RESTLEAF. |
MITRE ATT&CK
T1005 · Data from Local SystemTHUMBSBD collects victim system information and enumerates the file system; FOOTWINE also supports file and directory enumeration.T1041 · Exfiltration Over C2 ChannelTHUMBSBD stages collected output for exfiltration and copies it to removable media for transfer from air-gapped systems.T1053.005 · Scheduled TaskSNAKEDROPPER creates a scheduled task named rubyupdatecheck to run usbspeed.exe every five minutes.T1055 · Process InjectionRESTLEAF allocates executable memory, copies downloaded shellcode into it, and transfers execution to the shellcode entry point.T1056.001 · KeyloggingFOOTWINE captures keystrokes.T1059.001 · PowerShellThe malicious LNK launches PowerShell, which locates the LNK and extracts embedded payloads.T1091 · Replication Through Removable MediaVIRUSTASK propagates by copying payloads to removable media and replacing files with LNK shortcuts that infect a newly connected host.T1125 · Video CaptureFOOTWINE supports audio and video surveillance capture.T1204.002 · Malicious FileThe attack begins when a victim opens a malicious LNK file; infected-media LNK shortcuts also execute when a victim opens a hijacked file.
Threat Actors
APT37The article attributes the Ruby Jumper campaign and its malware tools to APT37, described as backed by the North Korean government.Ruby SleetThe article identifies Ruby Sleet as another name for APT37.ScarCruftThe article identifies ScarCruft as another name for APT37.Velvet ChollimaThe article identifies Velvet Chollima as another name for APT37.
Malware
BLUELIGHTtools, RESTLEAF, SNAKEDROPPER, THUMBSBD, and VIRUSTASK, download a payload that delivers FOOTWINE and BLUELIGHT, which enable surveillance on a victim’s system.FOOTWINEtools. These tools, RESTLEAF, SNAKEDROPPER, THUMBSBD, and VIRUSTASK, download a payload that delivers FOOTWINE and BLUELIGHT, which enable surveillance on a victim’s system.RESTLEAFshortcut (LNK) files to initiate an attack that utilizes a set of newly discovered tools. These tools, RESTLEAF, SNAKEDROPPER, THUMBSBD, and VIRUSTASK, download a payload that delivers FOOTWINE and BLUELIGHT, whichSNAKEDROPPERfiles to initiate an attack that utilizes a set of newly discovered tools. These tools, RESTLEAF, SNAKEDROPPER, THUMBSBD, and VIRUSTASK, download a payload that delivers FOOTWINE and BLUELIGHT, which enableTHUMBSBDinitiate an attack that utilizes a set of newly discovered tools. These tools, RESTLEAF, SNAKEDROPPER, THUMBSBD, and VIRUSTASK, download a payload that delivers FOOTWINE and BLUELIGHT, which enable surveillance on aVIRUSTASKthat utilizes a set of newly discovered tools. These tools, RESTLEAF, SNAKEDROPPER, THUMBSBD, and VIRUSTASK, download a payload that delivers FOOTWINE and BLUELIGHT, which enable surveillance on a victim’s system.
Vendors
ZohoThreatLabz discovered RESTLEAF, an initial implant that uses Zoho WorkDrive for C2 communications to fetch additional payloads, like SNAKEDROPPER.ZscalerIn December 2025, Zscaler ThreatLabz discovered a campaign linked to APT37 (also known as ScarCruft, Ruby Sleet, and Velvet Chollima), which is a threat group backed by the North Korean government. In this campaign,
Products
BackBlazeleverages several legitimate cloud providers, including Google Drive, Microsoft OneDrive, pCloud, and BackBlaze for its C2 communication. BLUELIGHT’s backdoor functionalities include executing arbitrary commands,Google Drivea previously documented backdoor which leverages several legitimate cloud providers, including Google Drive, Microsoft OneDrive, pCloud, and BackBlaze for its C2 communication. BLUELIGHT’s backdoorMicrosoft OneDrivedocumented backdoor which leverages several legitimate cloud providers, including Google Drive, Microsoft OneDrive, pCloud, and BackBlaze for its C2 communication. BLUELIGHT’s backdoor functionalities includeMicrosoft Windowsby the North Korean government. In this campaign, tracked as Ruby Jumper by ThreatLabz, APT37 uses Windows shortcut (LNK) files to initiate an attack that utilizes a set of newly discovered tools. These tools,pCloudbackdoor which leverages several legitimate cloud providers, including Google Drive, Microsoft OneDrive, pCloud, and BackBlaze for its C2 communication. BLUELIGHT’s backdoor functionalities include executing arbitraryRubyIn December 2025, Zscaler ThreatLabz discovered a campaign linked to APT37 (also known as ScarCruft, Ruby Sleet, and Velvet Chollima), which is a threat group backed by the North Korean government. In this campaign,Zoho WorkDriveThreatLabz discovered RESTLEAF, an initial implant that uses Zoho WorkDrive for C2 communications to fetch additional payloads, like SNAKEDROPPER.