Two never-before-seen tools, from same group, infect air-gapped devices
It’s hard enough creating one air-gap-jumping tool. GoldenJackal did it 2x in 5 years.
If it was possible to export data via email or to google drive, those systems were not actually air-gapped.
I think the thing they are relying on is USB drives to connect to the air gapped machines and then to a networked machine later. Obviously this is a failure in the air gapped system but it happens.
But still, this is not something one should call "air-gapped".