ScarCruft Uses Zoho WorkDrive and USB Malware to Breach Air-Gapped Networks

Zscaler ThreatLabz attributes a multi-stage surveillance campaign dubbed "Ruby Jumper" to North Korean actor ScarCruft (APT37). The campaign uses malicious LNK files and PowerShell to deploy RESTLEAF (which leverages Zoho WorkDrive for C2), followed by SNAKEDROPPER, THUMBSBD, VIRUSTASK, FOOTWINE and BLUELIGHT. Notably, THUMBSBD and VIRUSTASK weaponize removable media to bridge internet-connected hosts and air-gapped systems, and FOOTWINE provides keylogging, audio/video capture, screenshots, file exfiltration and arbitrary command execution, while several payloads abuse legitimate cloud storage services for command-and-control and payload distribution.