APT37 Targets Air-Gapped Networks With Novel Malware Strain

In December 2025, researchers uncovered a new cyber-espionage campaign attributed to APT37, also known as ScarCruft, Ruby Sleet, and Velvet Chollima.

The operation, tracked as “Ruby Jumper,” introduces a novel malware toolkit designed to breach isolated, air-gapped environments via removable media.

APT37 has long targeted government entities, journalists, and individuals aligned with DPRK interests.

This latest campaign shows a clear evolution in capability, combining cloud-based command-and-control (C2), shellcode loaders, and USB-based propagation to bypass network isolation.

The infection begins with a malicious Windows shortcut (LNK) file. When opened, it silently launches PowerShell and extracts multiple embedded payloads.

These include scripts and encrypted shellcode that ultimately deploy an initial implant known as RESTLEAF.

RESTLEAF communicates with attackers through Zoho WorkDrive, marking the first observed abuse of that platform by APT37. It retrieves additional payloads and executes them in memory using process injection.

The campaign follows a structured infection flow:

LNK file → PowerShell loader → Shellcode injection → RESTLEAF → SNAKEDROPPER → THUMBSBD / VIRUSTASK → FOOTWINE / BLUELIGHT

A key innovation in this campaign is the deployment of a full Ruby runtime environment. The malware component SNAKEDROPPER installs Ruby 3.3.0 in the ProgramData directory and renames the interpreter to “usbspeed.exe” to appear legitimate.

It then replaces a standard Ruby file with malicious code to ensure automatic execution via a scheduled task.

All payloads are encrypted with a simple one-byte XOR routine and executed reflectively in memory. This reduces forensic artifacts and complicates detection.

Bridging The Air Gap

Two components, THUMBSBD and VIRUSTASK, enable the compromise of air-gapped systems.

THUMBSBD acts as a backdoor and command relay. It uses removable media as a covert C2 channel, creating hidden $RECYCLE.BIN folders on USB drives.

Commands and stolen data are encrypted, transferred through USB devices, and executed once connected to another system. This effectively bridges network-segmented environments without direct internet access.

VIRUSTASK focuses on propagation. It infects removable drives by hiding legitimate files and replacing them with malicious shortcuts. When a victim clicks a file, the disguised Ruby interpreter executes embedded shellcode, infecting the new host.

Later in the chain, APT37 deploys FOOTWINE, a surveillance backdoor disguised as an Android package file. It supports keylogging, screenshot capture, audio recording, webcam monitoring, file manipulation, and remote shell access.

Communication with its C2 server at 144.172.106.66:8080 is encrypted using a custom XOR-based key exchange protocol.

The campaign also delivers BLUELIGHT, a previously documented backdoor that uses legitimate cloud storage providers for C2 operations.

Why It Matters

According to Zscaler, this campaign demonstrates how APT37 continues to refine its tactics.

By combining LNK-based social engineering, in-memory shellcode execution, cloud infrastructure abuse, and USB-driven lateral movement, the group has developed a complete toolkit for infiltrating air-gapped systems.

Organizations should monitor the execution of shortcut files, the creation of unusual Ruby installations, the creation of scheduled tasks, and the presence of hidden directories on removable media.

Physical access controls and endpoint monitoring are critical defenses against this evolving threat.

Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.