APT37 combines cloud storage and USB implants to infiltrate air-gapped systems

**Ruby Jumper — APT37 air-gap compromise:** Zscaler ThreatLabz uncovered a multi-stage campaign attributed to North Korea’s APT37 that begins with malicious LNK files and leverages Zoho WorkDrive for C2, a Ruby-based USB implant and utilities (THUMBSBD, VIRUSTASK, SNAKEDROPPER) to bridge air-gapped environments and deploy surveillance backdoors (RESTLEAF, FOOTWINE, BLUELIGHT) for data collection and exfiltration; the report emphasizes the sophisticated combination of cloud services and removable media to bypass network isolation and recommends heightened endpoint and physical access monitoring.