North Korea's APT37 Expands Toolkit to Breach Air-Gapped Networks

Zscaler ThreatLabz discovered APT37's 'Ruby Jumper' campaign that uses malicious LNK files and PowerShell to drop a multi-stage implant (Restleaf) and a set of previously undocumented tools (SnakeDropper, ThumbSBD, VirusTask, FootWine) to propagate via USB, abuse Zoho WorkDrive for C2 in connected networks, and exfiltrate data from air-gapped systems by staging stolen data on removable media.