Affected Systems

RubyGems ecosystem; specifically three malicious packages: git_credential_manager, Dendreo, and one unnamed gem. Affects Ruby developers who installed these packages on development machines.

Exploitation Status

Active supply chain attack. Malicious packages were published to RubyGems.org and capable of delivering additional payloads to developer machines. Current publication status and download count unknown.

Business Impact

Developer workstations may be compromised if malicious gems were installed. Risk of credential theft, code injection, or lateral movement from developer environments to production systems. Build pipelines and CI/CD systems using these packages are at risk. No CVE assigned; detection relies on package name identification rather than vulnerability signatures.

Urgency

🟠 Within 24 hours

Recommended Actions

  • Audit all Ruby projects and Gemfile.lock files for git_credential_manager, Dendreo, or other suspicious gems installed from RubyGems
  • Check RubyGems installation logs and bundle audit output on developer workstations and CI/CD runners for evidence of these packages
  • Review developer machine activity logs for unusual network connections or process execution following gem installation timestamps
  • Implement gem signature verification and restrict RubyGems sources to trusted internal mirrors with vetting processes
  • Rotate credentials and API keys on any systems where malicious gems were installed, prioritizing source code management and cloud provider access

---

# Threat Actor Context

Actor Profile

SleeperGem refers to both a threat actor and associated malware family involved in a software supply chain attack against the Ruby development ecosystem. The actor's motivation centers on compromising developer environments through malicious package distribution on the RubyGems repository. By publishing trojanized gems including git_credential_manager and Dendreo, the actor seeks to establish initial access on developer machines for subsequent payload delivery. The origin and broader attribution of SleeperGem remain unclear from available data, though the targeting of software developers suggests potential espionage or credential harvesting objectives.

TTPs (Tactics, Techniques, Procedures)

The SleeperGem campaign demonstrates classic software supply chain compromise techniques. Primary TTPs include: T1195.002 (Supply Chain Compromise: Compromise Software Supply Chain) through the publication of malicious packages to the legitimate RubyGems repository; T1204.002 (User Execution: Malicious File) as developers unknowingly install the rogue gems; and T1105 (Ingress Tool Transfer) for staging additional payloads to compromised developer workstations. The use of deceptive package names like git_credential_manager suggests T1036.005 (Masquerading: Match Legitimate Name or Location) to increase installation likelihood by mimicking legitimate development tools.

Targets & Patterns

SleeperGem specifically targets software developers working within the Ruby programming ecosystem. The choice of RubyGems as the distribution vector indicates focus on organizations and individuals actively developing Ruby applications. Software development sectors are particularly attractive targets because compromising developer environments can enable broader supply chain attacks, credential theft, intellectual property exfiltration, or pivot points into corporate networks. The use of developer-focused package names like git_credential_manager suggests the actor understands developer workflows and seeks to exploit trust in package repositories and common tooling patterns.

Historical Context

SleeperGem represents part of a broader trend of software supply chain attacks targeting package repositories across multiple ecosystems. Similar campaigns have targeted npm (JavaScript), PyPI (Python), and other developer-focused repositories. The technique of publishing malicious packages with names similar to legitimate tools or popular libraries has been observed in numerous campaigns over recent years, including typosquatting and dependency confusion attacks. However, specific historical links between SleeperGem and previously documented threat actors or campaigns are not established in the available data.

Defensive Recommendations

  • Implement package integrity verification by reviewing RubyGems dependencies before installation, checking package publication dates, maintainer reputation, and download statistics for anomalies
  • Deploy endpoint detection rules to monitor for suspicious Ruby gem installation activity, particularly packages executing network connections or file operations during installation hooks
  • Establish software composition analysis (SCA) tools in CI/CD pipelines to detect known malicious packages and flag newly published gems with minimal community vetting
  • Restrict developer workstation network egress to prevent unauthorized C2 communications, and monitor for unexpected outbound connections following gem installations (T1105)
  • Maintain an internal mirror or approved package repository for Ruby dependencies, requiring security review before new gems are added to the allowlist