ScarCruft Archives • Daily CyberSecurity

Bridging the Gap: North Korean APT37 Deploys ‘Ruby Jumper’ to Infiltrate Isolated Air-Gapped Networks

Bridging the Gap: North Korean APT37 Deploys ‘Ruby Jumper’ to Infiltrate Isolated Air-Gapped Networks

Do Son March 3, 2026

Zscaler unmasked APT37's "Ruby Jumper" campaign, which uses weaponized USBs and cloud services to bypass network isolation and steal data from air-gapped systems.

APT37 Expands Arsenal with Rustonotto Backdoor, PowerShell Chinotto, and FadeStealer North Korean Laptop Farm DPRK Insider Threat North Korea WMD Cyber Funding, Australia Sanctions Insider threat, North Korean hackers Kimsuky, cyber-espionage NPM Malware, North Korea Cyber-espionage North Korea, Remote IT Job Scam Laptop Farm - DriverEasy - Kimsuky Watering Hole Attack

North Korean Laptop Farm DPRK Insider Threat North Korea WMD Cyber Funding, Australia Sanctions Insider threat, North Korean hackers Kimsuky, cyber-espionage NPM Malware, North Korea Cyber-espionage North Korea, Remote IT Job Scam Laptop Farm - DriverEasy - Kimsuky Watering Hole Attack

APT37 Expands Arsenal with Rustonotto Backdoor, PowerShell Chinotto, and FadeStealer

Do Son September 10, 2025

A new report reveals North Korea's APT37 is using Rust-based malware called Rustonotto, marking a shift toward modern languages and multi-platform attacks.

ScarCruft APT Deploys VCD Ransomware, Uses PubNub & New Malware in Espionage Campaign North Korea APT, PubNub Abuse

ScarCruft APT Deploys VCD Ransomware, Uses PubNub & New Malware in Espionage Campaign

Do Son August 11, 2025

S2W TALON exposes ScarCruft (APT37), a North Korean APT using a new campaign disguised as a postal notice, deploying NubSpy and VCD ransomware via PubNub C2.

North Korean ScarCruft APT Targets Users with Novel KoSpy Android Spyware

Do Son March 15, 2025

Uncover insights on KoSpy Android Spyware, a new threat targeting Korean and English-speaking users with deceptive utility apps.

Squid Werewolf APT Masquerades as Recruiters in Espionage Campaign Targeting Key Employees WhatsApp Worm, Brazilian Banking Trojan LAPSUS$ Alliance, Scattered Spider Ransomware, Cybercrime RedCurl APT group Russian Cyberespionage, ApolloShadow Malware

WhatsApp Worm, Brazilian Banking Trojan LAPSUS$ Alliance, Scattered Spider Ransomware, Cybercrime RedCurl APT group Russian Cyberespionage, ApolloShadow Malware

Squid Werewolf APT Masquerades as Recruiters in Espionage Campaign Targeting Key Employees

Do Son March 14, 2025

Uncover the Squid Werewolf cyber-espionage campaign and its tactics to exploit fake job offers for cyberattacks.

North Korean APT-C-28 Expands Cyber Espionage Campaign

Do Son February 23, 2025

Learn how APT-C-28 operates in cyber espionage, targeting industries with advanced techniques and the RokRat Trojan.

North Korean Hackers Exploit Zero-Day Flaw (CVE-2024-38178) in “Operation Code on Toast” CVE-2024-38178 - TA-RedAnt - Operation Code on Toast

North Korean Hackers Exploit Zero-Day Flaw (CVE-2024-38178) in “Operation Code on Toast”

Do Son October 16, 2024

Stay protected from the Operation Code on Toast campaign. Find out about the new zero-day vulnerability CVE-2024-38178 in Microsoft IE and the targeted attack.

ScarCruft Strikes: North Korea’s Cyber Espionage Against Media and Experts Unveiled ScarCruft threat actor

ScarCruft Strikes: North Korea’s Cyber Espionage Against Media and Experts Unveiled

Do Son January 22, 2024

SentinelLabs unraveled a campaign orchestrated by ScarCruft threat actor targeting media organizations and experts on North Korean affairs