THUMBSBD
THUMBSBD is a backdoor used by the North Korean threat actor APT37, also tracked as ScarCruft, Ricochet Chollima, Ruby Sleet, Velvet Chollima, and InkySquid, in the Ruby Jumper campaign identified in December 2025. It is designed to compromise and operate across air-gapped Windows environments by weaponizing removable media as a covert bidirectional relay between internet-connected and isolated systems. THUMBSBD was reported as disguised as a Ruby file named ascii.rb and deployed after earlier Ruby Jumper stages involving malicious LNK files, PowerShell, RESTLEAF, and SNAKEDROPPER, which installs a disguised Ruby 3.3.0 runtime and persistence via a scheduled task named rubyupdatecheck.
Its core functionality is to collect system information, harvest reconnaissance data, create hidden directories on detected USB drives, stage operator command files, and copy data to removable media for later retrieval. Multiple reports describe it as enabling bidirectional command delivery and data exfiltration between segmented or air-gapped systems. Reported capabilities include harvesting system information, exfiltrating files, executing arbitrary commands, and downloading secondary payloads from remote infrastructure. One report states it stages hidden files in $RECYCLE.BIN on removable media and that commands are decrypted with a 1-byte XOR key on the air-gapped host before execution.
THUMBSBD is also used as a delivery mechanism for additional malware. It has been reported to deliver FOOTWINE, a Windows spyware backdoor disguised as an APK that supports keylogging, screenshot capture, audio and video recording, file manipulation, registry access, and remote shell commands, and to distribute BLUELIGHT, a backdoor previously associated with APT37 that uses legitimate cloud providers for command-and-control. In the same campaign, VIRUSTASK complements THUMBSBD by spreading infection to additional air-gapped machines via removable media, including replacing legitimate files with malicious LNK shortcuts.
High-confidence indicators and artifacts directly mentioned in the reporting include the filename ascii.rb for THUMBSBD; hidden directories on USB media including $RECYCLE.BIN or $RECYCLE.BIN.USER; associated scheduled task rubyupdatecheck from the broader infection chain; working directory %PROGRAMDATA%\usbspeed; registry key HKCU\SOFTWARE\Microsoft\TnGtp; and reported payload download infrastructure including philion[.]store, homeatedke[.]store, and hightkdhe[.]store.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
ScurCraft is notorious for using a broad range of custom malware, including THUMBSBD, which targets air-gapped Windows systems...
THUMBSBD, a backdoor that turns ordinary removable media into a covert two-way communication channel between internet-connected systems and isolated, air-gapped ones.
Techniques & procedures
15 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
1 technique
Initial Access
Execution
4 techniques
Execution
“…executes the operator’s commands — ranging from file exfiltration and system reconnaissance to arbitrary command execution.”
Initial infection vectors involve malicious LNK files that launch PowerShell commands to deploy embedded payloads.
Stealth
3 techniques
Stealth
“…decrypts them with a single-byte XOR key…” and “encrypted C2 channel using a custom XOR-based key exchange protocol.”
Discovery
3 techniques
Discovery
Collection
1 technique
Collection
Recent activity
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
THUMBSBD is custom malware used by ScarCruft that targets air-gapped Windows systems.
Backdoor enabling store-and-forward command/data relay via removable media between connected and air-gapped systems.
Removable-media (USB) component used to bridge air-gapped networks by relaying commands and exfiltrating data; delivers additional payloads (e.g., FOOTWINE).
APT37-associated malware family designed for air-gap operations via removable media (file replacement on removable drives to move data/commands).
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.