RESTLEAF
RESTLEAF is a Windows implant/backdoor used in the North Korea–linked APT37 (aka ScarCruft/Ricochet Chollima/InkySquid) “Ruby Jumper” campaign (reported by Zscaler ThreatLabz; first identified December 2025). In the described intrusion chain, a malicious Windows LNK file launches PowerShell that carves embedded components (including a decoy document and scripts) and ultimately spawns the RESTLEAF Windows executable payload in-memory as the first-stage downloader/implant.
RESTLEAF’s distinguishing behavior is command-and-control over Zoho WorkDrive cloud storage. It authenticates to Zoho WorkDrive using token material (including embedded refresh-token credentials and hardcoded client_id/client_secret/refresh_token) to obtain a valid access token for API operations. After successful authentication, RESTLEAF attempts to download shellcode (noted as “AAA.bin”) from Zoho WorkDrive and executes it via process injection (allocating executable memory, copying the payload, and transferring execution to the shellcode entry point). RESTLEAF is also described as beaconing by creating timestamped files in a Zoho WorkDrive folder named “Second,” with filenames matching the pattern “lion [timestamp].”
RESTLEAF is part of a multi-component toolkit used to breach segmented/air-gapped environments: it fetches further payloads after authentication, including the next-stage Ruby-based loader SNAKEDROPPER, which installs a disguised Ruby 3.3.0 runtime and persistence (scheduled task “rubyupdatecheck”), and later stages that weaponize removable media (THUMBSBD/VIRUSTASK) and deliver surveillance tooling (e.g., FOOTWINE for keylogging and audio/video capture).
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
The full attack chain flows from the initial LNK file through RESTLEAF as the first-stage downloader...
The full attack chain flows from the initial LNK file through RESTLEAF as the first-stage downloader...
Techniques & procedures
11 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
1 technique
Initial Access
Execution
3 techniques
Execution
Privilege Escalation
1 technique
Privilege Escalation
Stealth
3 techniques
Stealth
“…shellcode is executed through a classic process injection technique. RESTLEAF allocates executable memory, copies the downloaded payload into this region, and transfers execution…”
Command and Control
4 techniques
Command and Control
“RESTLEAF uses Zoho WorkDrive cloud storage for C2 communications… enabling subsequent API operations with the Zoho WorkDrive infrastructure.”
“RESTLEAF… uses Zoho WorkDrive for C2 communications to fetch additional payloads…”
Recent activity
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Initial implant using Zoho WorkDrive as C2 to retrieve additional payloads.
Backdoor used in the Ruby Jumper campaign that leverages Zoho WorkDrive as a command-and-control channel and can retrieve additional payloads after authenticating to the service.
In-memory Windows backdoor that abuses Zoho WorkDrive for command-and-control, downloads additional shellcode, and executes it via process injection to advance the infection chain.
First-stage downloader component in the Ruby Jumper infection chain, used to fetch/execute subsequent payloads.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.