Full Report
Cybersecurity researchers have flagged a new software supply chain attack codenamed SleeperGem targeting the Ruby ecosystem after three malicious gems were published to RubyGems with the end goal of serving additional payloads. The rogue gems are listed below - git_credential_manager (versions 2.8.0, 2.8.1, 2.8.2, 2.8.3) - Published on July 18, 2026 Dendreo (versions 1.1.3, 1.1.4) -
Analysis Summary
# Tool/Technique: SleeperGem (Malicious RubyGems Campaign)
## Overview
SleeperGem is a software supply chain attack targeting the RubyGems ecosystem. It involves the publication of malicious gems—some as new typosquatting packages and others as updates to long-dormant legitimate accounts. Its primary goal is to drop persistent backdoors on developer machines while intentionally avoiding execution within CI/CD build environments.
## Technical Details
- **Type:** Malware Family / Loader
- **Platform:** Linux, Windows, macOS (Ruby ecosystem)
- **Capabilities:** Environment Fingerprinting, Downloader, Persistence, Privilege Escalation (SUID)
- **First Seen:** July 18, 2026 (Initial discovery of the `git_credential_manager` variant)
## MITRE ATT&CK Mapping
- **[TA0001 - Initial Access]**
- [T1195.001 - Supply Chain Compromise: Compromise Software Dependencies]
- **[TA0002 - Execution]**
- [T1059.001 - Command and Scripting Interpreter: PowerShell]
- [T1059.004 - Command and Scripting Interpreter: Unix Shell]
- **[TA0003 - Persistence]**
- [T1053.003 - Scheduled Task/Job: Cron]
- [T1543.002 - Create or Modify System Process: Systemd Service]
- **[TA0004 - Privilege Escalation]**
- [T1548.001 - Abuse Elevation Control Mechanism: Setuid and Setgid]
- **[TA0005 - Defense Evasion]**
- [T1497.001 - Virtualization/Sandbox Evasion: System Checks] (CI/CD environment detection)
## Functionality
### Core Capabilities
- **Supply Chain Injection:** Infiltrates the Ruby ecosystem via typosquatting (`git_credential_manager` mimicking Microsoft's tool) or hijacking dormant accounts (`Dendreo`, `fastlane-plugin-run_tests_firebase_testlab`).
- **Environment Awareness:** Scans for ~30 environment variables related to CI/CD platforms (GitHub Actions, GitLab, Jenkins, etc.). If detected, the malware terminates to avoid analysis by automated build systems.
- **Payload Delivery:** Downloads second-stage payloads (`deploy.sh` and a native binary) from a Forgejo instance.
### Advanced Features
- **Stealthy Persistence:** Establishes itself as a `systemd` user service and a `cron` job.
- **Privilege Escalation:** Checks if the user has passwordless `sudo` access. If so, it installs a setuid root copy of a system shell at `/usr/local/sbin/ping6` to provide permanent root access disguised as a network utility.
- **Dependency Propagation:** The malicious `git_credential_manager` gem was added as a dependency to other packages, facilitating lateral spread within the ecosystem.
## Indicators of Compromise
- **File Names:**
- `~/.local/share/gcm/` (Malicious daemon location)
- `/usr/local/sbin/ping6` (Location of the setuid root shell)
- `deploy.sh`
- **Network Indicators:**
- `git[.]disroot[.]org/git-ecosystem` (C2/Payload Host)
- **Behavioral Indicators:**
- Unexpected `cron` or `systemd` service creation for "gcm" or "git-credential-manager."
- Unauthorized modifications to environment variables or shell profiles.
## Associated Threat Actors
- Unknown; however, the attacker uses the handle **LR-DEV** on RubyGems and likely compromised the **pinkroom** account.
## Detection Methods
- **Behavioral detection:** Monitor for Ruby processes spawning shell scripts or downloading binaries from unconventional domains.
- **Audit Persistence:** Scan `crontab` and `systemd` unit files for entries pointing to `~/.local/share/gcm/`.
- **Integrity Checks:** Verify the integrity of `/usr/local/sbin/ping6` to ensure it is not a shell binary with the SUID bit set.
## Mitigation Strategies
- **Package Pinning:** Use `Gemfile.lock` to ensure only verified versions of dependencies are used.
- **Account Security:** Enforce Multi-Factor Authentication (MFA) for all gem maintainers to prevent account takeovers of dormant projects.
- **Code Review:** Audit new or updated dependencies, especially those that have been dormant for years.
- **Least Privilege:** Avoid configuring passwordless `sudo` for developer accounts to prevent automated privilege escalation.
## Related Tools/Techniques
- **Typosquatting:** Similar to previous attacks on NPM and PyPI.
- **Dependency Confusion:** Exploiting how package managers resolve internal vs. external dependencies.