CampaignPublished 26 Feb 2026

APT37 Adds New Capabilities for Air-Gapped Networks

Source AlienVault OTX General

Description

APT37, a DPRK-backed threat group, has launched a new campaign called Ruby Jumper, utilizing Windows shortcut files to initiate attacks with newly discovered tools. These tools include RESTLEAF, SNAKEDROPPER, THUMBSBD, and VIRUSTASK, which work together to deliver surveillance payloads like FOOTWINE and BLUELIGHT. The campaign leverages removable media to infect and communicate with air-gapped systems. Key features include the use of Ruby for shellcode-based payloads, abuse of cloud storage services for command and control, and sophisticated techniques for bypassing network isolation. The malware demonstrates advanced capabilities in system reconnaissance, data exfiltration, and persistent surveillance.

Impact

Organizations with air-gapped networks, often found in critical infrastructure, government, defense, and high-security research environments, face significant risk from this campaign. Successful compromise can lead to unauthorized surveillance, theft of sensitive intellectual property, and exposure of classified information. The ability to bypass network isolation using removable media and cloud storage for command and control undermines traditional security assumptions about air-gapped environments. Persistent access and advanced evasion techniques increase the difficulty of detection and remediation, potentially allowing prolonged espionage activities. The campaign could disrupt operational integrity and confidentiality, leading to strategic disadvantages, reputational damage, and regulatory consequences. Additionally, the use of cloud services for C2 may implicate third-party providers and complicate incident response efforts. The medium severity rating reflects the complexity of exploitation but acknowledges that initial infection requires physical access or user interaction with removable media, somewhat limiting the attack surface.

Defensive guidance

To mitigate this threat, organizations should implement strict controls on removable media usage, including disabling autorun features and enforcing strict scanning policies with advanced endpoint detection solutions capable of identifying malicious shortcut files and Ruby-based shellcode. Employ application whitelisting to prevent unauthorized execution of unknown binaries and scripts. Network segmentation should be enhanced to monitor and restrict outbound traffic to cloud storage services, using anomaly detection to identify unusual data flows. Implement strong user training focused on the risks of removable media and social engineering attacks. Deploy endpoint detection and response (EDR) tools with capabilities to detect process injection, credential dumping, and masquerading behaviors. Regularly audit and monitor system logs for indicators of compromise related to the identified hashes and domains. Physical security controls should be strengthened to limit unauthorized access to air-gapped systems. Incident response plans must include procedures for handling removable media infections and cloud-based C2 communications. Finally, collaborate with cloud service providers to monitor and block malicious activities leveraging their platforms.

Indicators of compromise

Domains 6

hightkdhe.store
homeatedke.store
philion.store
www.hightkdhe.store
www.homeatedke.store
www.philion.store

Hashes 8

098d697f29b94c11b52c51bfe8f9c47d
4214818d7cde26ebeb4f35bc2fc29ada
476bce9b9a387c5f39461d781e7e22b9
57dac5f7d21da2454d0fbefdced80bf3
585322a931a49f4e1d78fb0b3f3c6212
5c6ff601ccc75e76c2fc99808d8cc9a9
709d70239f1e9441e8e21fcacfdc5d08
ad556f4eb48e7dba6da14444dcce3170

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 26 Feb 2026, 20:47 UTC

MITRE ATT&CK techniques19 from threat tags

Technical details

Indicators of compromise

Domains 6

Hashes 8

Community reviews

Related threats