APT37 Adds New Capabilities for Air-Gapped Networks

Zscaler ThreatLabz details APT37’s Ruby Jumper campaign, which abuses malicious LNK files, Zoho WorkDrive, and a stealthy bundled Ruby runtime to deploy new tools (RESTLEAF, SNAKEDROPPER, THUMBSBD, VIRUSTASK) and backdoors (FOOTWINE, BLUELIGHT). The operation uses process injection, reflective loading, and scheduled tasks, and uniquely leverages removable media to propagate and relay commands/data across air-gapped environments. The report provides host and network IoCs, documents active C2 infrastructure, and maps techniques to MITRE ATT&CK.