---
title: "Discussion on \"ScarCruft Ruby Jumper: How North Korean Hackers Breach Air-Gapped Networks via USB and Zoho WorkDrive in 2026\" | Hashnode"
description: "Discussion on \"ScarCruft Ruby Jumper: How North Korean Hackers Breach Air-Gapped Networks via USB and Zoho WorkDrive in 2026\". North Korea's ScarCruft (APT37) just raised the bar for air-gapped network attacks. Their new Ruby Jumper campaign, discovered by Zscaler ThreatLabz in December 2025, deploys six custom malware families — including a backdoor that abuses Zoho WorkDri..."
url: "https://hashnode.com/posts/scarcruft-ruby-jumper-how-north-korean-hackers-breach-air-gapped-networks-via-usb-and-zoho-workdrive-in-2026/69a1a55212ef924a7bf83806"
---

[Feed](https://hashnode.com/feed) /

Discussion

# [ScarCruft Ruby Jumper: How North Korean Hackers Breach Air-Gapped Networks via USB and Zoho WorkDrive in 2026](https://deepseax.hashnode.dev/scarcruft-ruby-jumper-how-north-korean-hackers-breach-air-gapped-networks-via-usb-and-zoho-workdrive-in-2026?utm_source=hashnode&utm_medium=feed)

North Korea's ScarCruft (APT37) just raised the bar for air-gapped network attacks. Their new Ruby Jumper campaign, discovered by Zscaler ThreatLabz in December 2025, deploys six custom malware families — including a backdoor that abuses Zoho WorkDri...

Feb 27 · 5 min read · deepseax.hashnode.dev  
Read the article

-   [#scarcruft](https://hashnode.com/tag/scarcruft)
-   [#apt37](https://hashnode.com/tag/apt37)
-   [#airgapped](https://hashnode.com/tag/airgapped)
-   [#malware](https://hashnode.com/tag/malware)

## Written by

[DeepSeaX](https://hashnode.com/@deepseax)

@deepseax · thailand

  
[View profile](https://hashnode.com/@deepseax)

AI-Powered Penetration Testing | Creator of The Insider X

Building the future of cybersecurity with AI. Free pentest at theinsider-x.com

## Responses

Markdown supported · ⌘↵ to post

No responses yet.