FOOTWINE
FOOTWINE is a Windows spyware/backdoor payload observed in Zscaler ThreatLabz reporting as part of the North Korea–linked APT37/ScarCruft campaign dubbed “Ruby Jumper” (discovered December 2025). It is delivered later in the intrusion chain by the removable-media backdoor THUMBSBD, in operations designed to bridge internet-connected and air-gapped Windows environments via weaponized USB drives.
Capabilities attributed to FOOTWINE in the provided content include surveillance and remote-access functionality: keystroke logging, screenshot capture, audio recording, video recording, file manipulation, registry access, remote shell/command execution, and “full shell access.” It is described as being disguised as an Android package (APK) and delivered as an encrypted payload (noted as “foot.apk”) with an integrated shellcode launcher.
Command-and-control is described as using a custom binary protocol over TCP, including a custom XOR-based key exchange followed by session-key encryption.
Associated tradecraft and related components in the same campaign (context) include initial access via malicious Windows LNK files that launch PowerShell to carve embedded payloads and open a decoy document; RESTLEAF using Zoho WorkDrive for C2; SNAKEDROPPER installing a disguised Ruby 3.3.0 runtime and persistence via a scheduled task (rubyupdatecheck); and THUMBSBD/VIRUSTASK using hidden directories (including $RECYCLE.BIN) on removable media for bidirectional command relay and propagation to air-gapped systems.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
The final payload, FOOTWINE, delivers surveillance capabilities including keylogging, audio capture, video capture, and full shell access...
The final payload, FOOTWINE, delivers surveillance capabilities including keylogging, audio capture, video capture, and full shell access...
Techniques & procedures
18 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
1 technique
Initial Access
Execution
4 techniques
Execution
“…executes the operator’s commands — ranging from file exfiltration and system reconnaissance to arbitrary command execution.”
Initial infection vectors involve malicious LNK files that launch PowerShell commands to deploy embedded payloads.
Stealth
2 techniques
Stealth
Credential Access
2 techniques
Credential Access
Collection
5 techniques
Collection
Command and Control
4 techniques
Command and Control
“FOOTWINE… pxm Establishes a proxy connection and relays traffic bidirectionally.”
"pxm , for setting up a proxy connection and relaying traffic bidirectionally."
Recent activity
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Later-stage backdoor with surveillance features including keylogging and audio/video capture.
Post-compromise capability providing keylogging plus audio/video capture, communicating over a custom TCP protocol; delivered via THUMBSBD.
Encrypted surveillance payload with integrated shellcode launcher; provides keylogging plus audio/video capture and communicates to C2 via a custom binary TCP protocol.
Surveillance payload providing keylogging, audio/video capture, and remote shell access over an encrypted C2 channel using a custom XOR-based key exchange protocol.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.