Bridging the Gap: North Korean APT37 Deploys ‘Ruby Jumper’ to Infiltrate Isolated Air-Gapped Networks

Zscaler ThreatLabz uncovered the 'Ruby Jumper' campaign attributed to APT37 that employs malicious LNK shortcuts to deploy a Ruby runtime (SNAKEDROPPER), weaponizes removable media via THUMBSBD and VIRUSTASK to bridge air-gapped networks, and delivers surveillance payloads (FOOTWINE, BLUELIGHT) which perform keylogging, audio/video capture, and file exfiltration while leveraging cloud services for C2 and data theft.