APT37 Ruby Jumper Campaign — Air-Gapped Network Bridging via THUMBSBD USB Worm, RESTLEAF Zoho WorkDrive C2, SNAKEDROPPER Ruby 3.3.0 Runtime Hijack, FOOTWINE/BLUELIGHT Surveillance Backdoors
APT37 Ruby Jumper Campaign (TL-2026-0150), also tracked as Ruby Jumper, is a high-severity advanced persistent threat campaign, first published 2026-02-27. It is attributed to APT37 (North Korea) with high confidence, affects Multiple Windows Endpoints (Defense/Government), maps to 28 MITRE ATT&CK techniques (T1016, T1025, T1027), and is covered by 9 detection rules and 20 indicators of compromise.
Key facts for TL-2026-0150
- Threat ID
- TL-2026-0150
- Also known as
- Ruby Jumper
- Severity
- HIGH
- Status
- ACTIVE
- Category
- APT
- First published
- 2026-02-27
- Last reviewed
- 2026-02-27
- Attribution
- APT37
- Attribution confidence
- HIGH
- Nation-state nexus
- North Korea
- Motivation
- ESPIONAGE
- Target sectors
- government, defense, military, intelligence
- Target regions
- Middle East, Asia, Global
- Detection rules
- 9
- Indicators of compromise
- 20
Malware and tooling in APT37 Ruby Jumper Campaign
Malware and tooling: BLUELIGHT, FOOTWINE, RESTLEAF, SNAKEDROPPER, THUMBSBD
Zscaler ThreatLabz discovered APT37 (ScarCruft/Ruby Sleet) deploying five malware families in the 'Ruby Jumper' campaign to bridge air-gapped networks. The attack chain uses malicious LNK files to deploy RESTLEAF (first observed APT37 abuse of Zoho WorkDrive for C2), SNAKEDROPPER (Ruby 3.3.0 runtime hijack masquerading as USB utility), THUMBSBD (USB-based air-gap bridging with bidirectional C2), VIRUSTASK (removable media propagation via file hijacking), and FOOTWINE/BLUELIGHT surveillance backdoors targeting defense and government sectors.
How APT37 Ruby Jumper Campaign works
APT37 (ScarCruft/Ruby Sleet/Velvet Chollima), a DPRK-backed threat group, has launched the 'Ruby Jumper' campaign — a sophisticated multi-stage operation designed to compromise air-gapped networks through USB-based bridging. The campaign was discovered by Zscaler ThreatLabz and represents a significant evolution in APT37's capabilities, marking the first time this group has demonstrated air-gap bridging and Zoho WorkDrive abuse for C2.
The infection chain begins with malicious LNK files containing an Arabic-language decoy document about the Palestine-Israel conflict (translated from a North Korean newspaper). When opened, the LNK launches PowerShell to carve embedded payloads including find.bat, search.dat, and viewer.dat — a batch launcher, PowerShell loader, and encrypted shellcode respectively.
RESTLEAF is the initial C2 component, using hardcoded Zoho WorkDrive OAuth credentials (client_id: 1000.3GYW7TSOWPQUNLVY1SK3Y6TWIUNAFH) to authenticate and download shellcode (AAA.bin) from cloud storage. It performs classic process injection and creates timestamped beacon files (pattern: 'lion [timestamp]') in a 'Second' folder on the WorkDrive to signal active infection.
APT37's custom two-stage shellcode launcher encrypts payloads with single-byte XOR keys. Stage 1 injects into a randomly chosen legitimate Windows executable from System32/SysWow64. Stage 2 reflectively loads the embedded PE payload after XOR decryption.
SNAKEDROPPER deploys a complete Ruby 3.3.0 runtime environment to %PROGRAMDATA%\usbspeed, renaming rubyw.exe to usbspeed.exe (USB utility masquerade). It replaces operating_system.rb — RubyGems' auto-loaded default file — with malicious code that uses Windows API calls (VirtualAlloc, RtlMoveMemory, VirtualProtect, CreateThread) via Ruby's Fiddle FFI. Three shellcode-bearing files are dropped disguised as Ruby scripts: bundler_index_client.rb (VIRUSTASK), ascii.rb (THUMBSBD), and task.rb (initially blank, later populated for propagation). A scheduled task 'rubyupdatecheck' executes every 5 minutes.
THUMBSBD is the air-gap bridging component. It uses removable media as a bidirectional covert C2 relay between connected and air-gapped systems. Working directories (CMD, MCD, OCD, PGI, RST, UEE, WRK) stage data for exfiltration and command execution. THUMBSBD creates hidden $RECYCLE.BIN directories on USB devices, encrypts staged data with 0x83 XOR, and supports commands for file exfiltration, backdoor operations, and payload delivery. C2 endpoints: philion.store, homeatedke.store, hightkdhe.store (last one operational during research). System reconnaissance includes dxdiag, ipconfig /all, process enumeration, recursive file tree, and connectivity tests.
VIRUSTASK propagates to new air-gapped systems by hijacking files on removable media. It hides original files and replaces them with identically-named LNK shortcuts pointing to the Ruby interpreter. When victims click hijacked files on a new host, usbspeed.exe loads malicious operating_system.rb which checks for existing infection (Dir.exist? c:\programdata\usbspeed) and executes shellcode from task.rb on uninfected systems.
FOOTWINE is the surveillance backdoor (delivered as foot.apk despite being a Windows PE), featuring keystroke logging, audio/video capture, screenshot capability, shell management, file manipulation, registry operations, process enumeration, proxy relay, and plugin loading. It uses a custom XOR-based key exchange protocol with 32-byte validation constant for encrypted TCP C2.
BLUELIGHT is a previously documented APT37 backdoor leveraging Google Drive, OneDrive, pCloud, and BackBlaze for multi-cloud C2 with command execution, file enumeration, payload delivery, and self-removal capabilities.
MITRE ATT&CK techniques used in TL-2026-0150
discovery
T1016 System Network Configuration Discovery; T1057 Process Discovery; T1082 System Information Discovery; T1083 File and Directory Discovery
collection
T1025 Data from Removable Media; T1056.001 Keylogging; T1113 Screen Capture; T1123 Audio Capture; T1125 Video Capture
defense-evasion
T1027 Obfuscated Files or Information; T1036.005 Match Legitimate Resource Name or Location; T1055 Process Injection; T1070.006 Timestomp; T1140 Deobfuscate/Decode Files or Information; T1564.001 Hidden Files and Directories
exfiltration
T1052.001 Exfiltration over USB; T1567.002 Exfiltration to Cloud Storage
execution
T1053.005 Scheduled Task; T1059.001 PowerShell; T1059.003 Windows Command Shell; T1204.002 Malicious File
command-and-control
T1071.001 Web Protocols; T1090 Proxy; T1102.002 Bidirectional Communication; T1132.001 Standard Encoding
lateral-movement
T1091 Replication Through Removable Media
persistence
T1547.001 Registry Run Keys / Startup Folder
initial-access
Affected products and versions in APT37 Ruby Jumper Campaign
- Multiple — Windows Endpoints (Defense/Government)
Vulnerable versions: Windows 10; Windows 11; Windows Server 2016+ - Ruby — Ruby Runtime
Vulnerable versions: 3.3.0 (abused as carrier) - Zoho — WorkDrive
Vulnerable versions: Cloud service (abused as C2)
Remediation for APT37 Ruby Jumper Campaign
Immediate actions
- Block C2 domains at DNS/proxy: philion.store, homeatedke.store, hightkdhe.store
- Hunt for scheduled task 'rubyupdatecheck' across all endpoints
- Search for %PROGRAMDATA%\usbspeed directory and ruby3.zip staging
- Monitor for Zoho WorkDrive API calls from non-browser processes (OAuth token exchange to accounts.zoho.com)
- Quarantine and scan all USB devices connected to high-value/air-gapped systems
- Check for hidden $RECYCLE.BIN and $RECYCLE.BIN.USER directories on removable media
Workarounds
- Block execution of rubyw.exe/usbspeed.exe from ProgramData paths
- Disable scheduled task creation for non-admin users
- Enable file extension visibility and hidden file display on all endpoints
- Monitor registry keys HKCU\SOFTWARE\Microsoft\TnGtp and HKCU\Software\Microsoft\ActiveUSBPolicies
Longer-term hardening
- Implement USB device control policies — whitelist approved devices only for air-gapped networks
- Deploy EDR with removable media monitoring and LNK execution alerting
- Block PowerShell execution from LNK file contexts via AppLocker/WDAC policies
- Monitor for Ruby interpreter processes in non-development environments
- Implement network segmentation monitoring for cloud storage API calls from unexpected hosts
- Disable autorun/autoplay on all endpoints and enforce via GPO
Weaknesses (CWE) in APT37 Ruby Jumper Campaign
CWE-506, CWE-829, CWE-912
Timeline of APT37 Ruby Jumper Campaign
- Volexity documents BLUELIGHT backdoor used by APT37/InkySquid via browser exploits
- APT37 documented deploying novel malware to spy on journalists using custom shellcode launcher (same launcher reused in Ruby Jumper)
- Zscaler reports APT37 targeting Windows with Rust backdoor and Python loader — evolution toward multi-language tooling
- Ruby Jumper campaign assessed to be actively targeting defense and government sectors with air-gap bridging capability
- Zscaler confirms hightkdhe.store C2 domain was operational during investigation
- Zscaler ThreatLabz publishes full analysis of Ruby Jumper campaign including RESTLEAF, SNAKEDROPPER, THUMBSBD, VIRUSTASK, FOOTWINE, and BLUELIGHT. Source: https://www.zscaler.com/blogs/security-research/apt37-adds-new-capabilities-air-gapped-networks
- Threadlinqs Intelligence publishes TL-2026-0150 with full MITRE mapping, IOCs, detections, and simulations
- As of 2026-05-29, the APT37 Ruby Jumper air-gap campaign remains ACTIVE — it is malware/TTP-driven (no CVE to patch) and sources (BleepingComputer, Zscaler) describe it as ongoing. APT37/ScarCruft is plainly operating, with fresh post-disclosure campaigns (Apr Facebook/RokRAT, May ESET gaming supply-chain), and no takedown or successor reported.
Sources cited for APT37 Ruby Jumper Campaign
- Zscaler ThreatLabz: APT37 Adds New Capabilities for Air-Gapped Networks
- Volexity: North Korean APT InkySquid Infects Victims Using Browser Exploits (BLUELIGHT)
- Dark Reading: DPRK State Actors Deploying Novel Malware to Spy on Journalists
- MITRE ATT&CK: APT37 Group Profile
- Zscaler: APT37 Targets Windows with Rust Backdoor and Python Loader
- CISA: North Korean State-Sponsored Cyber Actors
Threats related to APT37 Ruby Jumper Campaign
- NarwhalRAT: APT37 Python-based RAT delivered via LNK/PowerShell/Python loader chain in Microsoft-themed Korean spear-phishing campaign
- NarwhalRAT: APT37-Linked Python RAT Deployed via Fake Microsoft OTP-Abuse Alerts Against South Korean Targets
- ScarCruft (APT37) Deploys Python-Based NarwhalRAT via Fake Microsoft Account Security Alerts and LNK-in-ZIP Staging with pCloud Dead-Drop C2
Detection coverage for TL-2026-0150
As of 2026-02-27, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0150 across Splunk SPL, Microsoft KQL and Sigma, covering 20 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.