“We detected GoldenJackal tools at a South Asian embassy in Belarus in August and September 2019, and again in July 2021.”
GoldenJackal built two separate toolsets to cross air gaps and hit an EU government organization from May 2022 to March 2024. The stolen files left through Google Drive and Outlook SMTP servers. Air-gapped means nobody plugs a cable in. It never meant nobody plugs a USB stick in.