SleeperGem Uses Three Malicious RubyGems Packages to Target Developer Machines

1. Executive summary

Three malicious RubyGems packages — git_credential_manager (v2.8.0–2.8.3), Dendreo (v1.1.3, v1.1.4), and fastlane-plugin-run_tests_firebase_testlab (v0.3.2) — were published to RubyGems as part of a supply-chain attack codenamed "SleeperGem." The gems function as loaders that fetch a second-stage payload from an attacker-controlled Forgejo instance, deliberately skip execution on CI runners, and deploy a persistent native daemon on developer workstations. The actor "SleeperGem" has no MITRE ATT&CK profile; attribution is unconfirmed. EMEA financial services development teams using Ruby and the RubyGems ecosystem are directly exposed: the malware targets developer machines to harvest credentials and establish long-term persistence, potentially compromising source code, signing keys, and deployment pipelines.

2. Regulatory framing

No specific DORA incident-reporting article (Art. 19) is triggered here absent evidence of a major ICT-related incident at a client; this advisory addresses preventive exposure.

3. Technical analysis & attack chain

Attribution caveat: The name "SleeperGem" is a researcher-assigned campaign label. The actor has no MITRE ATT&CK profile in the verified reference data; attribution is unconfirmed. The technical detail below is drawn from Step Security's analysis and The Hacker News reporting; key claims about the attack chain rest on a single vendor (Step Security) — single-sourced; verify before enforcement.

Attack chain

1. Initial access — malicious gem publication. The attacker published three rogue gems to RubyGems without matching commits or tags in the source repositories: - git_credential_manager v2.8.0, 2.8.1, 2.8.2, 2.8.3 — published July 18, 2026. This gem typosquats/impersonates the legitimate Microsoft Git Credential Manager. - Dendreo v1.1.3, 1.1.4 — published October 14, 2017 (dormant since October 24, 2020 before receiving the malicious update). - fastlane-plugin-run_tests_firebase_testlab v0.3.2 — published February 6, 2018 (inactive since March 9, 2019 before the malicious update).
2. Dependency propagation. git_credential_manager was added as a dependency to five packages, causing the payload to spread to existing users: - Dendreo - fastlane-plugin-run_tests_firebase_testlab - slackHtmlToMarkdown - seo_optimizer - array_fast_methods

All five except fastlane-plugin-run_tests_firebase_testlab are maintained by the same RubyGems account ("LR-DEV"). The fastlane-plugin-run_tests_firebase_testlab gem belongs to a different maintainer ("pinkroom"), indicating at least two maintainer accounts were likely compromised.

3. CI environment detection. Upon installation (triggered when the library is required), the malicious code scans for approximately 30 environment variables associated with CI/build systems: GitHub Actions, GitLab, CircleCI, Travis, Jenkins, and Vercel. If any are present, the malware exits immediately. This is an intentional anti-analysis/anti-CI technique to ensure execution only on developer workstations.
4. Second-stage retrieval. The gem fetches two payloads from a public Forgejo instance at git.disroot[.]org/git-ecosystem: - A shell script: deploy.sh - A native binary named to match the impersonated tool (i.e., git_credential_manager).

On Windows, the retrieved payload is executed via PowerShell.

5. Persistence and privilege escalation (v2.8.3). Version 2.8.2 stages the payloads; version 2.8.3 advances the attack: - The install script (deploy.sh) launches the binary as a background daemon. - Persistence is established via a cron entry and a systemd user service. - The script queries sudo and wheel group membership. - If the user can run sudo without a password, the script re-runs itself as root. - When running as root, it plants a setuid root copy of the system shell at /usr/local/sbin/ping6 — a path chosen to mimic a legitimate networking utility.
6. Daemon installation path. The dropped daemon is installed at ~/.local/share/gcm/.

Key technical specifics

4. Mitigation & containment

P1 — Within 24 hours

1. Identify installed malicious gems. On all developer workstations and build agents running Ruby: bash gem list git_credential_manager gem list Dendreo gem list fastlane-plugin-run_tests_firebase_testlab gem list slackHtmlToMarkdown gem list seo_optimizer gem list array_fast_methods If any of the listed malicious versions are present, treat the machine and all associated secrets as compromised.
2. Isolate affected machines. Remove compromised developer workstations from the network. Rotate all credentials that may have been accessible on those machines: Git tokens, SSH keys, API keys, cloud credentials, CI/CD tokens, and any secrets stored in environment variables or credential managers.
3. Check for daemon and persistence. On any machine that installed the malicious gems: - Check for the daemon at ~/.local/share/gcm/ and remove it. - Inspect cron entries: crontab -l (and /etc/cron.d/, /var/spool/cron/ if root compromise is suspected). - Inspect systemd user services: systemctl --user list-units --type=service and check ~/.config/systemd/user/. - Check for a setuid shell at /usr/local/sbin/ping6: bash ls -la /usr/local/sbin/ping6 find /usr/local/sbin/ -perm -4000 If present, remove it immediately: sudo rm /usr/local/sbin/ping6.
4. Block C2 infrastructure. Block git.disroot[.]org at network egress (firewall, DNS sinkhole, proxy).

P2 — Within 72 hours

5. Uninstall malicious gems and pin safe versions. bash gem uninstall git_credential_manager gem uninstall Dendreo gem uninstall fastlane-plugin-run_tests_firebase_testlab If git_credential_manager functionality is required, install the legitimate Microsoft Git Credential Manager from its official source, not RubyGems. For Dendreo and fastlane-plugin-run_tests_firebase_testlab, pin to the last known-good versions published before the malicious updates (pre-October 2017 for Dendreo; pre-February 2018 for fastlane-plugin).
6. Audit Gemfile.lock files. Search all repositories for dependencies on the six affected packages: bash grep -r "git_credential_manager\|Dendreo\|fastlane-plugin-run_tests_firebase_testlab\|slackHtmlToMarkdown\|seo_optimizer\|array_fast_methods" Gemfile.lock Remove or replace any references to the malicious versions.
7. Review RubyGems account security. Audit all organisational RubyGems accounts for MFA enrolment. Enable 2FA on all maintainer accounts. The attack exploited dormant accounts — review accounts with no recent activity and revoke credentials where appropriate.

P3 — Within 7 days

8. Implement dependency pinning and integrity verification. Enforce pinned gem versions in all Gemfiles. Consider using bundle install --deployment with checksummed lockfiles. Evaluate tools that detect typosquatted or anomalous gem publications.
9. Review CI/CD pipeline security. Although the malware deliberately avoids CI runners, the compromised gems may have been installed in CI environments before the CI-evasion logic executed. Audit CI build logs for gem installation of the affected packages.
10. Forensic review of source code and deployments. If any compromised developer machine had push access to repositories, review recent commits for unauthorised changes. The setuid shell at /usr/local/sbin/ping6 indicates potential root-level access — perform full host forensic analysis on any machine where it was found.

5. Indicators of compromise

domain  git[.]disroot[.]org
filepath  ~/.local/share/gcm/
filepath  /usr/local/sbin/ping6
gem  git_credential_manager:2.8.0
gem  git_credential_manager:2.8.1
gem  git_credential_manager:2.8.2
gem  git_credential_manager:2.8.3
gem  Dendreo:1.1.3
gem  Dendreo:1.1.4
gem  fastlane-plugin-run_tests_firebase_testlab:0.3.2
gem  slackHtmlToMarkdown
gem  seo_optimizer
gem  array_fast_methods
file  deploy.sh
account  LR-DEV
account  pinkroom

6. Detection

rule SleeperGem_RubyGems_Loader {
  meta:
    author = "Adverse Trace"
    date = "2026-07-20"
    reference = "https://www.stepsecurity.io/blog/sleepergem-compromised-rubygems-drop-persistent-backdoor"
    description = "Detects SleeperGem malicious gem loader strings and C2 references"
  strings:
    $c2_host = "git.disroot.org" ascii
    $c2_path = "/git-ecosystem" ascii
    $deploy_script = "deploy.sh" ascii
    $daemon_path = ".local/share/gcm/" ascii
    $setuid_path = "/usr/local/sbin/ping6" ascii
    $ci_check_gh = "GITHUB_ACTIONS" ascii
    $ci_check_gl = "GITLAB" ascii
    $ci_check_cc = "CIRCLECI" ascii
    $ci_check_tr = "TRAVIS" ascii
    $ci_check_jk = "JENKINS" ascii
    $ci_check_vc = "VERCEL" ascii
  condition:
    $c2_host and $c2_path and ($deploy_script or $daemon_path or $setuid_path) and 3 of ($ci_check_*)
}

rule SleeperGem_Persistence_Script {
  meta:
    author = "Adverse Trace"
    date = "2026-07-20"
    reference = "https://www.stepsecurity.io/blog/sleepergem-compromised-rubygems-drop-persistent-backdoor"
    description = "Detects SleeperGem deploy.sh persistence and privilege escalation indicators"
  strings:
    $setuid_shell = "/usr/local/sbin/ping6" ascii
    $daemon_dir = ".local/share/gcm/" ascii
    $sudo_group = "wheel" ascii
    $sudo_cmd = "sudo" ascii
    $systemd_service = "systemctl" ascii
    $cron = "crontab" ascii
  condition:
    ($setuid_shell or $daemon_dir) and 2 of ($sudo_group, $sudo_cmd, $systemd_service, $cron)
}

title: SleeperGem Malicious RubyGems Daemon or setuid Shell Detected
id: 7a3c1f2e-2026-0720-0001
status: experimental
author: Adverse Trace
date: 2026/07/20
description: >
  Detects creation of the SleeperGem persistent daemon at ~/.local/share/gcm/,
  the setuid shell at /usr/local/sbin/ping6, or network connections to the
  Forgejo C2 at git.disroot.org.
references:

  - https://www.stepsecurity.io/blog/sleepergem-compromised-rubygems-drop-persistent-backdoor
  - https://thehackernews.com/2026/07/sleepergem-uses-three-malicious.html
logsource:
  product: linux
  category: file_event
detection:
  daemon_path:
    TargetFilename|contains: ".local/share/gcm/"
  setuid_shell:
    TargetFilename: "/usr/local/sbin/ping6"
  condition: daemon_path or setuid_shell
falsepositives:

  - Legitimate use of /usr/local/sbin/ping6 (unlikely; ping6 is typically at /usr/sbin/ping6)
level: high

title: SleeperGem Forgejo C2 Network Connection
id: 7a3c1f2e-2026-0720-0002
status: experimental
author: Adverse Trace
date: 2026/07/20
description: Detects network connections to the SleeperGem Forgejo C2 host.
references:

  - https://www.stepsecurity.io/blog/sleepergem-compromised-rubygems-drop-persistent-backdoor
logsource:
  product: linux
  category: network_connection
detection:
  c2_connection:
    DestinationHostname|contains: "git.disroot.org"
  condition: c2_connection
falsepositives:

  - Legitimate access to disroot.org Forgejo instances (verify process and user context)
level: high

7. Sources

• The Hacker News — "SleeperGem Uses Three Malicious RubyGems Packages to Target Developer Machines" — https://thehackernews.com/2026/07/sleepergem-uses-three-malicious.html — 2026-07-20
• Step Security — "SleeperGem: Compromised git_credential_manager, Dendreo, and fastlane RubyGems Drop a Persistent Backdoor" — https://www.stepsecurity.io/blog/sleepergem-compromised-rubygems-drop-persistent-backdoor — 2026-07-20

8. Adverse Trace position

This is a credible and active software supply-chain attack targeting Ruby developers, with a well-designed CI-evasion mechanism and persistent backdoor deployment. The technique of hijacking dormant maintainer accounts to push malicious gem updates without source repository commits is difficult to detect pre-installation and represents a systemic risk to the Ruby ecosystem. Attribution to "SleeperGem" is a campaign label only — no MITRE ATT&CK profile exists and the actor remains unconfirmed. The technical detail is single-sourced from Step Security; we assess the indicators as reliable but recommend independent verification before large-scale enforcement actions. EMEA financial services clients with Ruby development teams should immediately audit for the six affected gems, block the C2 domain, and rotate any credentials that were present on machines where the malicious gems were installed. Adverse Trace will monitor for additional malicious packages, new C2 infrastructure, and any follow-on payload delivery.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.