Excerpt
Technical Analysis
APT37 Ruby Jumper: Air-Gap Attack via Removable Media
ThreatLabz details the Ruby Jumper campaign in the following sections, focusing on the specific malware employed, the deployment methods, and how the final payload is delivered to achieve the ultimate objective. Attack flow
The figure below illustrates the complete attack flow, from the initial vector to the infection of newly attached removable media and the deployment of FOOTWINE and BLUELIGHT.
Figure 1: APT37 Ruby Jumper campaign attack flow.…
The opening of the report, shown for reference. The full report, with its figures and indicators, is published by Zscaler on zscaler.com.
Mentioned in the excerpt
More from Zscaler6
- msupdater-trojan-and-link-targeted-attacksZscaler · Added 19 Oct
- Technical Analysis of 2CLoaderZscaler · Published 30 Sep
- Vidar Virtual Machine-Based String ObfuscationZscaler · Published 21 Sep
- C2Looper Backdoor Uses GitHub for C2Zscaler · Published 17 Aug
On the same topics
- Retrohunting APT37: North Korean APT used VBA self decode technique to inject RokRatMalwarebytes · Published 5 Jan 2021
- Kazuar (Malware Family)Malpedia · Added 18 Oct
- Chinese Nation-State Hackers Target U.S in Operation TradeSecret, Report Claimseweek.com · Published 6 Apr 2017
- Taiwan High-Tech Ecosystem Targeted by Foreign APT Group:Medium · Published 10 Jun 2022
