Individuals and governments organizations · 26/02/2026
Researchers at Zscaler discover Ruby Jumper, a campaign designed to infiltrate air-gapped networks, leveraging USB drives for lateral movement and data exfiltration. [Date Occurred: Since at least December 2025; Date Discovered: During December 2025]
APT37 Adds New Capabilities for Air-Gapped Networks · Thu, 26 Feb 2026 15:16:34 GMT
IntroductionIn December 2025, Zscaler ThreatLabz discovered a campaign linked to APT37 (also known as ScarCruft, Ruby Sleet, and Velvet Chollima), which is a threat group backed by the North Korean government. In this campaign, tracked as Ruby Jumper by ThreatLabz, APT37 uses Windows shortcut (LNK) files to initiate an attack that utilizes a set of newly discovered tools. These tools, RESTLEAF, SNAKEDROPPER, THUMBSBD, and VIRUSTASK, download a payload that delivers FOOTWINE and BLUELIGHT, which enable surveillance on a victim’s system.In this blog post, ThreatLabz examines how these tools function, including their notable use of Ruby to load shellcode-based payloads. We also explore how the Ruby Jumper campaign leverages removable media to infect and pass commands and information between air-gapped systems. Key Takeaways In December 2025, ThreatLabz discovered Ruby Jumper, a campaign orchestrated by APT37, a DPRK-backed threat group.ThreatLabz discovered RESTLEAF, an initial implant that uses Zoho WorkDrive for C2 communications to fetch additional payloads, like SNAKEDROPPER.ThreatLabz discovered SNAKEDROPPER, a next-stage loader that installs the Ruby runtime, establishes ...
APT37 Ruby Jumper: Air-Gap Attack via Removable Media · 2026-02-26
Zscaler ThreatLabz exposes APT37's Ruby Jumper campaign; new malware tools using removable media to breach air-gapped networks.