APT37 hackers use new malware to breach air-gapped networks

A North Korea-linked threat actor tracked as APT37 has been observed using five new malicious tools in a recent campaign targeting air-gapped systems, Zscaler reports. Also tracked as ScarCruft, Ruby Sleet, and Velvet Chollima, APT37 has been active since 2012, focusing on data theft and surveillance and mainly targeting entities in South Korea. As part of a campaign discovered in December 2025, named Ruby Jumper, APT37 was seen using LNK files to execute a PowerShell script and deploy multiple payloads, including a decoy document in Arabic about the Palestine-Israel conflict. The payloads work together to execute a payload in memory. Dubbed RestLeaf, it uses the Zoho WorkDrive cloud storage for command-and-control (C&C) and attempts to fetch a file containing shellcode from it. The shellcode, which is executed in memory, acts as a launcher, fetching and decrypting second-stage shellcode that loads an embedded Windows executable, dubbed SnakeDropper. The malware creates a working directory and installs the Ruby 3.3.0 runtime environment disguised as a USB speed monitoring utility, backdoors the Ruby interpreter, and creates a scheduled task to execute the interpreter every five minutes, establishing persistence. Executed every time the Ruby interpreter starts, SnakeDropper drops ThumbsBD, a backdoor that uses removable drives to exfiltrate data from air-gapped systems, using them as bidirectional relays. When detecting USB drives, the malware creates a hidden directory in their root folder, which is used to stage backdoor commands and data for exfiltration. ThumbsBD also collects system information, downloads additional payloads, and executes shellcode from a specific directory. SnakeDropper was also observed dropping VirusTask, a removable media propagation tool designed to infect air-gapped systems, which exclusively weaponizes USB drives for initial access. It copies the payload executables to a folder in the drive’s root directory and enumerates files on the drive, replacing them with LNK files that lead to the execution of shellcode on the air-gapped systems when the user attempts to open those files. “VirusTask complements ThumbsBD to form a complete air-gap attack toolkit. While ThumbsBD handles C&C communication and data exfiltration, VirusTask ensures the malware spreads to new systems through social engineering by replacing legitimate files with malicious shortcuts that victims trust and execute,” Zscaler explains. The security firm also observed ThumbsBD deploying FootWine, an encrypted Android package file containing a shellcode launcher with surveillance capabilities, such as keystroke logging and audio and video capturing. FootWine supports various surveillance-related commands, including file manipulation, shell management, and registry and process manipulation. “ThumbsBD and VirusTask weaponize removable media to bypass network isolation and infect air-gapped systems. To maintain a strong security posture, the security community should focus on monitoring endpoint activity and physical access points to counter this threat and other campaigns led by APT37,” Zscaler notes. Related: North Korean Hackers Distributed Android Spyware via Google Play Related: North Korean Hackers Target macOS Developers via Malicious VS Code Projects Related: FBI: North Korean Spear-Phishing Attacks Use Malicious QR Codes

North Korean hackers are deploying newly uncovered tools to move data between internet-connected and air-gapped systems, spread via removable drives, and conduct covert surveillance. The malicious campaign has been named Ruby Jumper and is attributed to the state-backed group APT37, also known as ScarCruft, Ricochet Chollima, and InkySquid. Air-gapped computers are disconnected from external networks, especially the public internet. Physical isolation is achieved at the hardware level by removing all connectivity (Wi-Fi, Bluetooth, Ethernet), while logical segregation relies on various software-defined controls, like VLANs and firewalls. In a physical air-gap environment, typical in critical infrastructure, military, and research sectors, data transfer is done through removable storage drives. Researchers at cloud security company Zscaler analyzed the malware employed in APT37's Ruby Jumper campaign and identified a toolkit of five malicious tools: RESTLEAF, SNAKEDROPPER, THUMBSBD, VIRUSTASK, and FOOTWINE. Bridging the air gap The infection chain begins when the victim opens a malicious Windows shortcut file (LNK), which deploys a PowerShell script that extracts payloads embedded in the LNK file. To divert attention, the script also launches a decoy document. Although the researchers did not specify any victims, they note that the document is an Arabic translation of a North Korean newspaper article about the Palestine-Israel conflict. The PowerShell script loads the first malware component, called RESTLEAF, an implant that communicates with APT37's command-and-control (C2) infrastructure using Zoho WorkDrive. RESTLEAF fetches encrypted shellcode from the C2 to download the next-stage payload, a Ruby-based loader named SNAKEDROPPER. The attack continues with installing the Ruby 3.3.0 runtime environment - complete with the interpreter, standard libraries, and gem infrastructure - disguised as a legitimate USB-related utility named usbspeed.exe. "SNAKEDROPPER is primed for execution by replacing the RubyGems default file operating_system.rb with a maliciously modified version that is automatically loaded when the Ruby interpreter starts," via a scheduled task (rubyupdatecheck) that executes every five minutes, the researchers say. The THUMBSBD backdoor is downloaded as a Ruby file named ascii.rb, as well as the VIRUSTASK malware as the bundler_index_client.rb file. The role of THUMBSBD is to collect system information, stage command files, and prepare data for exfiltration. Its most crucial function is to create hidden directories on detected USB drives and copy files to them. According to the researchers, the malware turns removable storage devices "into a bidirectional covert C2 relay." This allows the threat actor to deliver commands to air-gapped systems as well as extract data from them. “By leveraging removable media as an intermediary transport layer, the malware bridges otherwise air-gapped network segments,” Zscaler researchers say. VIRUSTASK's role is to spread the infection to new air-gapped machines, weaponizing removable drives by hiding legitimate files and replacing them with malicious shortcuts that execute the embedded Ruby interpreter when opened. The module will only trigger an infection process if the inserted removable media has at least 2GB of free space. Zscaler reports that THUMBSBD also delivers FOOTWINE, a Windows spyware backdoor disguised as an Android package file (APK) that supports keylogging, screenshot capture, audio and video recording, file manipulation, registry access, and remote shell commands. Another piece of malware also observed in the APT37's RubyJumper campaign is BLUELIGHT, a full-fledged backdoor previously associated with the North Korean threat group. Zscaler has high confidence attributing the RubyJumper campaign to APT37 based on several indicators, including the use of the BLUELIGHT malware, initial vector relying on LNK files, two-stage shellcode delivery technique, and C2 infrastructure typically observed in attacks from this actor. The researchers also note that the decoy document indicates that the target of the RubyJumper activity is interested in North Korean media narratives, which aligns with the victim profile of this threat group. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

A cyber espionage group linked to North Korea has been observed deploying a new malicious campaign using removable media infection tools to gain access to air-gapped systems. The group, APT37, is well-known hacking team active since at least 2012 and known under many names, including ScarCruft, Ruby Sleet, InkySquid, Ricochet Chollima and Velvet Chollima. Initially focused on the public and private sectors in South Korea, the group expanded its operations in 2017 to include Japan, Vietnam and the Middle East, and to a wider range of industry verticals, including chemicals, electronics, manufacturing, aerospace, automotive and healthcare entities. In this new campaign, spotted by security researchers at Zscaler ThreatLabz and dubbed ‘Ruby Jumper,’ APT37 utilized a set of six malicious tools throughout the attack lifecycle, five of which had never been documented (Restleaf, SnakeDropper, ThumbSBD, VirusTask and FootWine). It also leveraged removable media to infect and pass commands and information between air-gapped systems. APT37’s Ruby Jumper Campaign Explained The Ruby Jumper campaign was discovered by the ThreatLabz team in December 2025. During this campaign, documented in a report published on February 26, APT37 gained access using the group’s traditional method: abusing Windows shortcut (LNK) files. When a victim opens a malicious LNK file, it launches a PowerShell command and scans the current directory to locate itself based on file size. Then, the PowerShell script launched by the LNK file carves multiple embedded payloads from fixed offsets within that LNK, including a decoy document, an executable payload, an additional PowerShell script and a batch file. This document displays an article about the Palestine-Israel conflict, translated from a North Korean newspaper into Arabic. The executable payload is a newly discovered implant, dubbed Restleaf by the ThreatLabz team, that uses Zoho WorkDrive for command-and-control (C2) communications to fetch additional payloads. “To our knowledge, this is the first time APT37 has abused Zoho WorkDrive,” the researchers noted. RestLeaf profiles the compromised system and establishes persistence before retrieving follow‑on components from Zoho WorkDrive. Among these is SnakeDropper, a loader responsible for decrypting and deploying additional modules in memory, reducing on‑disk artefacts. To extend access beyond the initially infected host, APT37 deploys ThumbSBD, a tool specifically designed to propagate via removable media. ThumbSBD monitors for connected USB drives, copies a tailored infection package onto them and abuses shortcut files to ensure execution when the drive is opened on another system. This enables lateral movement into isolated or segmented environments. When a USB device reaches an air‑gapped machine, the infection chain resumes. VirusTask executes as a lightweight backdoor, collecting system information and staging data for exfiltration. Because the system lacks direct internet access, APT37 again relies on removable media: stolen data is written back to the USB drive in hidden or obfuscated form. The operators also deploy FootWine, a reconnaissance and collection utility focused on harvesting documents and monitoring removable drive activity, ensuring valuable data is queued for extraction. Supporting these newer components is BlueLight, a previously documented APT37 tool used for command execution and data theft. In connected environments, BlueLight communicates with external C2 infrastructure. In air‑gapped scenarios, it facilitates tasking and data staging for delayed exfiltration via USB.