Zscaler details APT37’s Ruby Jumper: LNK + PowerShell carve payloads to load RESTLEAF (Zoho WorkDrive C2) → SNAKEDROPPER (installs Ruby) → THUMBSBD/VIRUSTASK; removable media bridge enables delivery of FOOTWINE and BLUELIGHT. #APT37 #malware #airgap https://bit.ly/4aRPdCM