ScarCruft (also known as APT37), a North Korean state-sponsored threat actor, has launched a sophisticated cyber espionage campaign named Ruby Jumper. Recently documented by Zscaler ThreatLabz, the campaign marks a significant evolution in the group’s ability to compromise highly secure, air-gapped networks.

Key Components of the Attack

The campaign utilizes a multi-stage infection chain that begins with a malicious Windows shortcut (LNK) file.

• RESTLEAF Backdoor: This initial implant is a Windows executable spawned in memory. It is notable for being the first time ScarCruft has been observed abusing Zoho WorkDrive for command-and-control (C2) communications. It uses the platform to fetch additional payloads and signals infection status by creating timestamped beacon files.
• SNAKEDROPPER: This next-stage loader is responsible for installing a Ruby runtime on the victim’s system, establishing persistence through scheduled tasks, and dropping the final-stage implants.
• THUMBSBD & VIRUSTASK: These are the primary tools used to breach network isolation:
  • VIRUSTASK: Focuses exclusively on weaponizing removable media (USB drives) to achieve initial access on air-gapped systems.
  • THUMBSBD: Functions as a backdoor that uses these same USB drives to relay commands and exfiltrate data between internet-connected and air-gapped machines.

Capabilities and Tactics

• Removable Media Bridge: The malware creates hidden folders on detected USB drives to stage operator commands for air-gapped systems or to store data stolen from them for later exfiltration.
• Surveillance Suite: The tools are designed to facilitate extensive surveillance, including taking screenshots, logging keystrokes, and even performing audio and video surveillance.
• Legitimate Cloud Abuse: Beyond Zoho, the campaign also leverages Google Drive, Microsoft OneDrive, and pCloud for secondary C2 operations.
• Strategic Targeting: ScarCruft is believed to operate under North Korea’s Ministry of State Security, primarily targeting media, government entities, and experts in North Korean affairs.