APT37 Ruby Jumper Campaign — Air-Gapped Network Bridging via THUMBSBD USB Worm, RESTLEAF Zoho WorkDrive C2, SNAKEDROPPER Ruby 3.3.0 Runtime Hijack, FOOTWINE/BLUELIGHT Surveillance Backdoors — Threadlinqs Intelligence
As of 2026-05-30, APT37 Ruby Jumper Campaign — Air-Gapped Network Bridging via THUMBSBD USB Worm, RESTLEAF Zoho WorkDrive C2, SNAKEDROPPER Ruby 3.3.0 Runtime Hijack, FOOTWINE/BLUELIGHT Surveillance Backdoors is a high-severity apt threat attributed to APT37 (North Korea), tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 20 indicators of compromise.
Threat ID: TL-2026-0150 · Severity: HIGH · Status: ACTIVE · Category: APT
Attribution: APT37 · North Korea · ESPIONAGE
Zscaler ThreatLabz discovered APT37 (ScarCruft/Ruby Sleet) deploying five malware families in the 'Ruby Jumper' campaign to bridge air-gapped networks. The attack chain uses malicious LNK files to
APT37 (ScarCruft/Ruby Sleet/Velvet Chollima), a DPRK-backed threat group, has launched the 'Ruby Jumper' campaign — a sophisticated multi-stage operation designed to compromise air-gapped networks through USB-based bridging. The campaign was discovered by Zscaler ThreatLabz and represents a significant evolution in APT37's capabilities, marking the first time this group has demonstrated air-gap bridging and Zoho WorkDrive abuse for C2.
The infection chain begins with malicious LNK files containing an Arabic-language decoy document about the Palestine-Israel conflict (translated from a North Korean newspaper). When opened, the LNK launches PowerShell to carve embedded payloads including find.bat, search.dat, and viewer.dat — a batch launcher, PowerShell loader, and encrypted shellcode respectively.
RESTLEAF is the initial C2 component, using hardcoded Zoho WorkDrive OAuth credentials (client_id: 1000.3GYW7TSOWPQUNLVY1SK3Y6TWIUNAFH) to authenticate and download shellcode (AAA.bin) from cloud storage. It performs classic process injection and creates timestamped beacon files (pattern: 'lion [timestamp]') in a 'Second' folder on the WorkDrive to signal active infection.
APT37's custom two-stage shellcode launcher encrypts payloads with single-byte XOR keys. Stage 1 injects into a randomly chosen legitimate Windows executable from System32/SysWow64. Stage 2 reflectively loads the embedded PE payload after XOR decryption.
SNAKEDROPPER deploys a complete Ruby 3.3.0 runtime environment to %PROGRAMDATA%\usbspeed, renaming rubyw.exe to usbspeed.exe (USB utility masquerade). It replaces operating_system.rb — RubyGems' auto-loaded default file — with malicious code that uses Windows API calls (VirtualAlloc, RtlMoveMemory, VirtualProtect, CreateThread) via Ruby's Fiddle FFI. Three shellcode-bearing files are dropped disguised as Ruby scripts: bundler_index_client.rb (VIRUSTASK), ascii.rb (THUMBSBD), and task.rb (initially blank, later populated for propagation). A scheduled task 'rubyupdatecheck' executes every 5 minutes.
THUMBSBD is the air-gap bridging component. It uses removable media as a bidirectional covert C2 relay between connected and air-gapped systems. Working directories (CMD, MCD, OCD, PGI, RST, UEE, WRK) stage data for exfiltration and command execution. THUMBSBD creates hidden $RECYCLE.BIN directories on USB devices, encrypts staged data with 0x83 XOR, and supports commands for file exfiltration, backdoor operations, and payload delivery. C2 endpoints: philion.store, homeatedke.store, hightkdhe.store (last one operational during research). System reconnaissance includes dxdiag, ipconfig /all, process enumeration, recursive file tree, and connectivity tests.
VIRUSTASK propagates to new air-gapped systems by hijacking files on removable media. It hides original files and replaces them with identically-named LNK shortcuts pointing to the Ruby interpreter. When victims click hijacked files on a new host, usbspeed.exe loads malicious operating_system.rb which checks for existing infection (Dir.exist? c:\programdata\usbspeed) and executes shellcode from task.rb on uninfected systems.
FOOTWINE is the surveillance backdoor (delivered as foot.apk despite being a Windows PE), featuring keystroke logging, audio/video capture, screenshot capability, shell management, file manipulation, registry operations, process enumeration, proxy relay, and plugin loading. It uses a custom XOR-based key exchange protocol with 32-byte validation constant for encrypted TCP C2.
BLUELIGHT is a previously documented APT37 backdoor leveraging Google Drive, OneDrive, pCloud, and BackBlaze for multi-cloud C2 with command execution, file enumeration, payload delivery, and self-removal capabilities.
Weaknesses (CWE)
CWE-506, CWE-829, CWE-912
Target sectors: government, defense, military, intelligence
Target regions: Middle East, Asia, Global
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 20 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
APT, HIGH, threat intelligence, cybersecurity, T1566.001, T1091, T1059.001, T1059.003, T1204.002, T1053.005, T1053.005, T1547.001, T1036.005, T1027