North Korea's APT37 Is Jumping Air Gaps With USB Malware and Cloud C2

THE STORY

Zscaler ThreatLabz published research today disclosing a campaign they've named "Ruby Jumper," attributed with high confidence to APT37 — also known as ScarCruft, Ruby Sleet, and Velvet Chollima. This is a North Korean state-sponsored espionage group active since at least 2012, historically targeting South Korean government entities, defense organizations, and individuals connected to DPRK state interests.

Ruby Jumper introduces five previously undocumented malware families: RESTLEAF, SNAKEDROPPER, THUMBSBD, VIRUSTASK, and FOOTWINE, alongside the previously known BLUELIGHT backdoor. Each tool serves a specific function in a multi-stage attack chain engineered to do something most malware cannot: breach networks with no internet connection.

The infection begins with a malicious Windows shortcut (LNK) file. When opened, it launches PowerShell and extracts multiple embedded payloads — including a decoy document (an Arabic-language article about the Palestine-Israel conflict, translated from a North Korean newspaper), an executable payload, and additional scripts. The initial implant, RESTLEAF, authenticates with Zoho WorkDrive using embedded refresh tokens and downloads shellcode from the cloud service. This is the first documented instance of APT37 abusing Zoho WorkDrive for C2.

Once established on an internet-connected host, the infection chain deploys SNAKEDROPPER, which installs a self-contained Ruby runtime environment, sets up persistence through scheduled tasks, and drops the two components that make this campaign operationally unique: THUMBSBD and VIRUSTASK.

THUMBSBD is the air-gap bridge. When a USB drive is connected to an infected internet-facing machine, THUMBSBD copies encrypted command files into a hidden $RECYCLE.BIN directory on the drive — invisible under default Windows Explorer settings. When that same drive is plugged into an air-gapped machine running the THUMBSBD implant, it reads those hidden files, decrypts them with a single-byte XOR key, and executes the commands. Results and exfiltrated data are staged in the same hidden directory, ready to be carried back out when the drive returns to a connected system.

VIRUSTASK handles the other side: it focuses exclusively on weaponizing removable media to propagate the malware to clean air-gapped systems that haven't been infected yet. Together, these two components create a bidirectional command channel that requires no network connectivity whatsoever.

The final payloads include FOOTWINE, an encrypted backdoor with keylogging, audio capture, and video capture capabilities, and BLUELIGHT, a mature backdoor that can abuse Google Drive, OneDrive, pCloud, and BackBlaze for C2.

THE ADVERSARY PERSPECTIVE

Your Air Gap Is a Process Problem, Not a Security Control

From an offensive security perspective, Ruby Jumper is a masterclass in targeting the assumption that physical network isolation equals security. Every organization running an air-gapped environment — OT networks, classified R&D labs, defense installations, SCADA systems, nuclear facilities — relies on the belief that no internet connection means no remote attacker access. APT37 just built a toolkit specifically designed to prove that belief wrong.

The key insight attackers are exploiting: air-gapped networks aren't truly isolated. They depend on human processes — patching via USB, data transfer via removable media, maintenance workflows that connect the disconnected. Every USB drive that crosses the boundary is a potential command channel, and APT37 has engineered an automated system to exploit exactly that.

The cloud C2 abuse is equally significant. By using Zoho WorkDrive, OneDrive, Google Drive, and pCloud, APT37 makes their C2 traffic indistinguishable from normal business cloud storage usage. You can't block these services in most enterprise environments without breaking legitimate workflows. This forces defenders into the much harder problem of behavioral analysis on cloud API traffic — a capability most SOCs don't have.

The "portable runtime" approach — deploying a self-contained Ruby interpreter onto the target — is also a trend worth tracking. It eliminates dependency on whatever's installed on the victim machine and creates a consistent execution environment for the attacker's tools. Expect other threat actors to adopt this pattern.

DEFENSIVE TAKEAWAYS