# APT37 Ruby Jumper Campaign — Air-Gapped Network Bridging via THUMBSBD USB Worm, RESTLEAF Zoho WorkDrive C2, SNAKEDROPPER Ruby 3.3.0 Runtime Hijack, FOOTWINE/BLUELIGHT Surveillance Backdoors

> Zscaler ThreatLabz discovered APT37 (ScarCruft/Ruby Sleet) deploying five malware families in the 'Ruby Jumper' campaign to bridge air-gapped networks. The attack chain uses malicious LNK files to deploy RESTLEAF (first observed APT37 abuse of Zoho WorkDrive for C2), SNAKEDROPPER (Ruby 3.3.0 runtime hijack masquerading as USB utility), THUMBSBD (USB-based air-gap bridging with bidirectional C2), VIRUSTASK (removable media propagation via file hijacking), and FOOTWINE/BLUELIGHT surveillance backdoors targeting defense and government sectors.

- **Published:** 2026-02-27T04:25:00Z
- **Last reviewed:** 2026-02-27T04:25:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0150
- **ID:** TL-2026-0150
- **Severity:** HIGH
- **Category:** APT
- **Status:** ACTIVE
- **Actor:** APT37 (North Korea)
- **Detections:** 9 · **IOCs:** 20 (full data via the Threadlinqs MCP server — Purple tier)

## Description

APT37 (ScarCruft/Ruby Sleet/Velvet Chollima), a DPRK-backed threat group, has launched the 'Ruby Jumper' campaign — a sophisticated multi-stage operation designed to compromise air-gapped networks through USB-based bridging. The campaign was discovered by Zscaler ThreatLabz and represents a significant evolution in APT37's capabilities, marking the first time this group has demonstrated air-gap bridging and Zoho WorkDrive abuse for C2.

The infection chain begins with malicious LNK files containing an Arabic-language decoy document about the Palestine-Israel conflict (translated from a North Korean newspaper). When opened, the LNK launches PowerShell to carve embedded payloads including find.bat, search.dat, and viewer.dat — a batch launcher, PowerShell loader, and encrypted shellcode respectively.

RESTLEAF is the initial C2 component, using hardcoded Zoho WorkDrive OAuth credentials (client_id: 1000.3GYW7TSOWPQUNLVY1SK3Y6TWIUNAFH) to authenticate and download shellcode (AAA.bin) from cloud storage. It performs classic process injection and creates timestamped beacon files (pattern: 'lion [timestamp]') in a 'Second' folder on the WorkDrive to signal active infection.

APT37's custom two-stage shellcode launcher encrypts payloads with single-byte XOR keys. Stage 1 injects into a randomly chosen legitimate Windows executable from System32/SysWow64. Stage 2 reflectively loads the embedded PE payload after XOR decryption.

SNAKEDROPPER deploys a complete Ruby 3.3.0 runtime environment to %PROGRAMDATA%\usbspeed, renaming rubyw.exe to usbspeed.exe (USB utility masquerade). It replaces operating_system.rb — RubyGems' auto-loaded default file — with malicious code that uses Windows API calls (VirtualAlloc, RtlMoveMemory, VirtualProtect, CreateThread) via Ruby's Fiddle FFI. Three shellcode-bearing files are dropped disguised as Ruby scripts: bundler_index_client.rb (VIRUSTASK), ascii.rb (THUMBSBD), and task.rb (initially blank, later populated for propagation). A scheduled task 'rubyupdatecheck' executes every 5 minutes.

THUMBSBD is the air-gap bridging component. It uses removable media as a bidirectional covert C2 relay between connected and air-gapped systems. Working directories (CMD, MCD, OCD, PGI, RST, UEE, WRK) stage data for exfiltration and command execution. THUMBSBD creates hidden $RECYCLE.BIN directories on USB devices, encrypts staged data with 0x83 XOR, and supports commands for file exfiltration, backdoor operations, and payload delivery. C2 endpoints: philion.store, homeatedke.store, hightkdhe.store (last one operational during research). System reconnaissance includes dxdiag, ipconfig /all, process enumeration, recursive file tree, and connectivity tests.

VIRUSTASK propagates to new air-gapped systems by hijacking files on removable media. It hides original files and replaces them with identically-named LNK shortcuts pointing to the Ruby interpreter. When victims click hijacked files on a new host, usbspeed.exe loads malicious operating_system.rb which checks for existing infection (Dir.exist? c:\programdata\usbspeed) and executes shellcode from task.rb on uninfected systems.

FOOTWINE is the surveillance backdoor (delivered as foot.apk despite being a Windows PE), featuring keystroke logging, audio/video capture, screenshot capability, shell management, file manipulation, registry operations, process enumeration, proxy relay, and plugin loading. It uses a custom XOR-based key exchange protocol with 32-byte validation constant for encrypted TCP C2.

BLUELIGHT is a previously documented APT37 backdoor leveraging Google Drive, OneDrive, pCloud, and BackBlaze for multi-cloud C2 with command execution, file enumeration, payload delivery, and self-removal capabilities.

## MITRE ATT&CK

- T1566.001 Spearphishing Attachment
- T1091 Replication Through Removable Media
- T1059.001 PowerShell
- T1059.003 Windows Command Shell
- T1204.002 Malicious File
- T1053.005 Scheduled Task
- T1547.001 Registry Run Keys / Startup Folder
- T1036.005 Match Legitimate Resource Name or Location
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1055 Process Injection
- T1070.006 Timestomp
- T1564.001 Hidden Files and Directories
- T1056.001 Keylogging
- T1082 System Information Discovery
- T1057 Process Discovery
- T1083 File and Directory Discovery
- T1016 System Network Configuration Discovery
- T1025 Data from Removable Media
- T1123 Audio Capture
- T1125 Video Capture
- T1113 Screen Capture
- T1102.002 Bidirectional Communication
- T1071.001 Web Protocols
- T1132.001 Standard Encoding
- T1090 Proxy
- T1052.001 Exfiltration over USB
- T1567.002 Exfiltration to Cloud Storage

## Sources

- [Zscaler ThreatLabz: APT37 Adds New Capabilities for Air-Gapped Networks](https://www.zscaler.com/blogs/security-research/apt37-adds-new-capabilities-air-gapped-networks)
- [Volexity: North Korean APT InkySquid Infects Victims Using Browser Exploits (BLUELIGHT)](https://www.volexity.com/blog/2021/08/17/north-korean-apt-inkysquid-infects-victims-using-browser-exploits/)
- [Dark Reading: DPRK State Actors Deploying Novel Malware to Spy on Journalists](https://www.darkreading.com/cyberattacks-data-breaches/dprk-state-actors-deploying-novel-malware-to-spy-on-journalists)
- [MITRE ATT&CK: APT37 Group Profile](https://attack.mitre.org/groups/G0067/)
- [Zscaler: APT37 Targets Windows with Rust Backdoor and Python Loader](https://www.zscaler.com/blogs/security-research/apt37-rust-backdoor-python-loader)
- [CISA: North Korean State-Sponsored Cyber Actors](https://www.cisa.gov/news-events/cybersecurity-advisories/north-korea)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0150