VIRUSTASK
VIRUSTASK is a Ruby-based removable media propagation component used in the North Korea-linked APT37 (aka ScarCruft/Ruby Sleet/Velvet Chollima/InkySquid) “Ruby Jumper” campaign (discovered by Zscaler ThreatLabz in Dec 2025) to spread infections into and across air-gapped Windows environments.
In the reported toolchain, VIRUSTASK is delivered as a Ruby file named bundler_index_client.rb (dropped by the SNAKEDROPPER stage alongside other disguised Ruby files). Its primary role is to weaponize removable drives to achieve initial access on isolated networks and to propagate to additional air-gapped machines. It does this by hiding victims’ legitimate files on the removable media and replacing them with malicious Windows LNK shortcuts using the same filenames; when a user clicks the apparent file, the LNK executes a renamed Ruby interpreter (masquerading as usbspeed.exe from a disguised Ruby 3.3.0 runtime installed under %PROGRAMDATA%\usbspeed) and loads additional malicious content (noted as loading shellcode from task.rb). Zscaler reported VIRUSTASK only triggers the infection process if the removable media has at least 2GB of free space.
VIRUSTASK is observed operating alongside THUMBSBD (a removable-media command relay/exfiltration component) and other Ruby Jumper malware families (RESTLEAF, SNAKEDROPPER, FOOTWINE, and BLUELIGHT) in operations that bridge internet-connected and air-gapped systems via USB tradecraft. No standalone network C2 behavior for VIRUSTASK is described in the provided content.
Known identifiers/IOCs explicitly mentioned for VIRUSTASK in the content:
- Filename used for delivery: bundler_index_client.rb
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Working alongside THUMBSBD is VIRUSTASK, which ensures the infection spreads further by replacing a victim’s legitimate files on the removable drive with malicious LNK shortcuts...
"Also delivered as a Ruby file, VIRUSTASK functions similar to THUMBSBD... as a removable media propagation component... focuses exclusively on weaponizing removable media to achieve initial access on air-gapped systems."
Techniques & procedures
10 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
1 technique
Initial Access
Execution
4 techniques
Execution
“Creates a scheduled task named rubyupdatecheck to execute… usbspeed.exe every 5 minutes.”
Initial infection vectors involve malicious LNK files that launch PowerShell commands to deploy embedded payloads.
Persistence
1 technique
Persistence
Privilege Escalation
1 technique
Privilege Escalation
Stealth
2 techniques
Stealth
Discovery
1 technique
Discovery
Recent activity
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Removable-media propagation tool that replaces files with malicious LNK shortcuts to spread via USB/removable drives.
Removable-media component focused on gaining initial access into air-gapped/isolated networks.
APT37-associated malware family designed for air-gap operations via removable media (file replacement on removable drives to move data/commands).
Removable-media propagation component focused on spreading the toolset to air-gapped systems and enabling initial access via infected removable media.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.