Affected Systems

RubyGems ecosystem: three malicious packages (git_credential_manager, Dendreo, and one unnamed) published to the official RubyGems repository. Affects Ruby developers who installed these packages.

Exploitation Status

Active supply chain attack. Malicious packages were published and available for installation. Current removal status and download count unknown.

Business Impact

Developer workstations compromised via trojanized gems can lead to credential theft, source code exfiltration, lateral movement into CI/CD pipelines, and potential production environment compromise. High risk for organizations with Ruby development teams. No CVE assigned as this is a supply chain poisoning incident rather than a software vulnerability.

Urgency

🔴 Immediate

Recommended Actions

  • Audit all Ruby projects for dependencies on git_credential_manager, Dendreo, or other suspicious gems using 'bundle list' and 'gem list'
  • Remove identified malicious packages immediately and scan affected developer workstations for indicators of compromise
  • Review RubyGems download logs and package-lock files (Gemfile.lock) in version control for evidence of installation
  • Implement dependency scanning tools (e.g., Bundler Audit, Dependabot) to detect malicious or vulnerable gems before installation
  • Rotate credentials and API keys on any developer machine that installed the malicious packages, especially Git and cloud service credentials

---

# Threat Actor Context

Actor Profile

SleeperGem represents a software supply chain threat campaign targeting the Ruby development ecosystem. The actor's motivation centers on compromising developer environments through malicious package distribution on the RubyGems repository. By publishing trojanized gems including git_credential_manager and Dendreo, the actor seeks to establish initial access on developer machines for subsequent payload delivery. The origin and attribution of SleeperGem remain unclear from available data, though the targeting of software developers suggests potential objectives ranging from intellectual property theft to supply chain compromise of downstream software products.

TTPs (Tactics, Techniques, Procedures)

The SleeperGem campaign employs supply chain compromise techniques consistent with MITRE ATT&CK T1195.001 (Compromise Software Dependencies and Development Tools). The actor leverages T1195.002 (Compromise Software Supply Chain) by publishing malicious packages to the legitimate RubyGems repository, exploiting developer trust in the ecosystem. Initial access (TA0001) is achieved through T1195 variants when developers install the rogue gems. The malicious packages are designed to serve as droppers or loaders for additional payloads, indicating multi-stage execution (T1204.002 - User Execution: Malicious File) once installed on developer workstations. The use of deceptive package names like git_credential_manager suggests possible typosquatting or masquerading techniques (T1036).

Targets & Patterns

SleeperGem specifically targets software developers working within the Ruby programming ecosystem. The focus on the software development sector reflects a strategic choice to compromise high-value targets with access to source code, development infrastructure, and potentially production deployment pipelines. Developers represent attractive targets due to their elevated privileges, access to sensitive intellectual property, and potential as vectors for downstream supply chain attacks affecting end users of software they produce. The targeting pattern suggests the actor seeks either direct access to proprietary code and credentials on developer machines, or aims to inject malicious code into legitimate software projects during the development lifecycle.

Historical Context

SleeperGem follows an established pattern of supply chain attacks targeting open-source package repositories, similar to previous campaigns affecting npm, PyPI, and other ecosystems. This campaign aligns with the broader trend of adversaries exploiting trust relationships in software supply chains, reminiscent of attacks like the 2021 ua-parser-js compromise and numerous typosquatting campaigns. The targeting of RubyGems specifically adds to the growing body of evidence that all major language package ecosystems face persistent threats from malicious package injection. The multi-package approach (three identified rogue gems) suggests a coordinated campaign rather than opportunistic activity.

Defensive Recommendations

  • Implement package verification controls including checksum validation and signature verification for all RubyGems dependencies before installation
  • Deploy software composition analysis (SCA) tools to scan Gemfile.lock and detect known malicious packages or suspicious dependencies in Ruby projects
  • Monitor for T1195.001/T1195.002 indicators by logging all gem installations and flagging newly published or low-reputation packages for manual review
  • Restrict developer workstation network egress to prevent unauthorized C2 communication, particularly from gem installation processes and Ruby interpreter child processes
  • Establish baseline behavior for gem installation activities and alert on anomalous post-installation execution patterns, file system modifications, or network connections