Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
3 IOCs
APT37 Adds New Capabilities for Air-Gapped Networks
Threat Actors
Malware Families
Excerpt
IntroductionIn December 2025, Zscaler ThreatLabz discovered a campaign linked to APT37 (also known as ScarCruft, Ruby Sleet, and Velvet Chollima), which is a threat group backed by the North Korean government. In this campaign, tracked as Ruby Jumper by ThreatLabz, APT37 uses Windows shortcut (LNK) files to initiate an attack that utilizes a set of newly discovered tools. These tools, RESTLEAF, SNAKEDROPPER, THUMBSBD, and VIRUSTASK, download a payload…
Read the original report →Diamond Model
Adversary(2)
Infrastructure(1)
Capability(1)
Victim
Indicators of Compromise
Open the mindmap →3 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| MD5 | 57dac5f7d21da2454d0fbefdced80bf3 | Medium | Score 53/100 | First seen |
| MD5 | 098d697f29b94c11b52c51bfe8f9c47d | Medium | Score 53/100 | First seen |
| Domain | hightkdhe.store | High | Score 58/100 | First seen |
IOC Relationship Graph
Building graph…