state-sponsored-espionageinitial-access-methodcommand-and-control-methodpersistence-method

ScarCruft (APT37) Ruby Jumper Campaign Targets Air-Gapped Systems via Zoho WorkDrive C2 and USB Malware

Threat Actor Intelligence · 3 sources · Updated 4mo ago · First seen Feb 27, 2026

North Korea-linked ScarCruft (APT37) has been attributed to a new espionage campaign dubbed Ruby Jumper that is designed to compromise air-gapped environments using a multi-stage infection chain and removable media. Zscaler ThreatLabz reported the activity was identified in December 2025 and described an initial access method that relies on a malicious Windows shortcut (.LNK); when opened, it triggers PowerShell to extract multiple embedded payloads (including a decoy document and staged scripts/binaries) from fixed offsets within the LNK and then decrypts and executes follow-on code in memory.

The toolset includes multiple malware components—reported as RESTLEAF, SNAKEDROPPER, THUMBSBD, VIRUSTASK, FOOTWINE (and additionally BLUELIGHT in one account)—used to progress execution, establish persistence, and enable surveillance. RESTLEAF was described as using Zoho WorkDrive for command-and-control, authenticating with a valid access token and downloading additional shellcode for execution (including via process injection), representing a noted shift to abusing a cloud storage service for C2; the campaign also includes an implant/workflow that uses removable media (USB) to relay commands and bridge isolated networks, enabling compromise of systems without direct internet connectivity.

Know this adversaryTTPs, infrastructure, and targeting history in one profile.

Get the profile

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

4 events · Dec 1, 2025 – Feb 27, 2026

Feb 27, 20268mo ago
Zscaler's findings on Ruby Jumper are publicly reported
Multiple outlets reported on February 27, 2026 that Zscaler had disclosed the Ruby Jumper campaign and its technical details, including attribution to APT37 and the use of cloud services plus removable media to compromise air-gapped networks. The reporting highlighted Zoho WorkDrive abuse as a newly observed ScarCruft command-and-control method.
Dec 1, 202511mo ago
Ruby Jumper uses USB malware to bridge internet-connected and air-gapped systems
APT37 used THUMBSBD and VIRUSTASK to weaponize removable media, storing encrypted commands and stolen data in hidden folders such as $RECYCLE.BIN on USB drives. This enabled bidirectional tasking, exfiltration, and propagation between connected hosts and isolated air-gapped machines, with additional surveillance payloads like FOOTWINE available for keylogging and audio/video capture.
Dec 1, 202511mo ago
APT37 deploys LNK-based infection chain with cloud-backed malware
In the campaign, victims were lured into opening a malicious Windows LNK file that launched PowerShell, extracted embedded payloads, and displayed an Arabic-language decoy document related to the Palestine-Israel conflict. The malware chain deployed components including RESTLEAF and SNAKEDROPPER, with command-and-control traffic routed through legitimate cloud services such as Zoho WorkDrive, OneDrive, Google Drive, and pCloud.
Dec 1, 202511mo ago
Zscaler identifies APT37's 'Ruby Jumper' campaign
Zscaler ThreatLabz discovered a new North Korea-linked campaign in December 2025 and attributed it with high confidence to APT37/ScarCruft. The operation targeted air-gapped Windows environments using a multi-stage malware toolkit and removable media.

Linked entities

Related entities

Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.

Open in app →

Threat actors

1 linked

APT37

Malware

5 linked

THUMBSBD VIRUSTASK SNAKEDROPPER RESTLEAF FOOTWINE

Do you run this?See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.

Get the Full Actor Profile

Source coverage

Sources

3 references tracked. Mallory keeps watching after this page renders.

The Hacker NewsNews · Feb 27, 2026

ScarCruft Uses Zoho WorkDrive and USB Malware to Breach Air-Gapped NetworksOpen source ↗

Cyber Security NewsNews · Feb 27, 2026

North Korean APT37 Hackers Leverages Novel Malware to Infect Air‑Gapped SystemsOpen source ↗

Bleeping ComputerNews · Feb 27, 2026

APT37 hackers use new malware to breach air-gapped networksOpen source ↗

Mallory platform

See the full picture, correlated to your attack surface.

This page covers what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which threat actors are using it right now, and what to deploy next.

Start Free Trial Open in App

Exposure mappingMap indicators from this story to your assets and identify affected systems in minutes.

Threat actor evidenceEvery observed campaign, victim, and pivot linked to actors named in this story.

Associated malwareMalware, exploits, and IOCs connected to the activity described here.

Detection signaturesYARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.

Scheduled alertsGet matching new stories delivered to your team as they break, not the next morning.

AI threadsAsk questions about this story and take action on the answers.

ScarCruft (APT37) Ruby Jumper Campaign Targets Air-Gapped Systems via Zoho WorkDrive C2 and USB Malware

How this story unfolded

Zscaler's findings on Ruby Jumper are publicly reported

Ruby Jumper uses USB malware to bridge internet-connected and air-gapped systems

APT37 deploys LNK-based infection chain with cloud-backed malware

Zscaler identifies APT37's 'Ruby Jumper' campaign

Related entities

Threat actors

Malware

Sources

See the full picture, correlated to your attack surface.

Related stories

Multiple APT and malware campaigns abusing phishing, cloud services, and signed binaries

Malware Delivery via Social Engineering: Phishing Lures, Fake Browser Alerts, and Paste-and-Run Payloads

ScarCruft Used HWP and CHM Lures to Deliver M2RAT and PowerShell Backdoors

ScarCruft (APT37) Ruby Jumper Campaign Targets Air-Gapped Systems via Zoho WorkDrive C2 and USB Malware

How this story unfolded

Zscaler's findings on Ruby Jumper are publicly reported

Ruby Jumper uses USB malware to bridge internet-connected and air-gapped systems

APT37 deploys LNK-based infection chain with cloud-backed malware

Zscaler identifies APT37's 'Ruby Jumper' campaign

Related entities

Threat actors

Malware

Sources

See the full picture, correlated to your attack surface.

Related stories

Multiple APT and malware campaigns abusing phishing, cloud services, and signed binaries

Malware Delivery via Social Engineering: Phishing Lures, Fake Browser Alerts, and Paste-and-Run Payloads

ScarCruft Used HWP and CHM Lures to Deliver M2RAT and PowerShell Backdoors