SleeperGem Supply-Chain Campaign Uses Three Malicious RubyGems Packages to Backdoor Developer Machines

Key facts for SleeperGem RubyGems dormant accounts

Detection coverage for SleeperGem RubyGems dormant accounts

As of 2026-07-20, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1575 across Splunk SPL, Microsoft KQL and Sigma, covering 21 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: SleeperGem — Ruby Gem Require-Time Child Process Spawns Installer Shell

Detects a Ruby process (bundler/gem require hook) spawning a child shell or PowerShell process immediately after `bundle install`/`gem install`, with no CI/CD environment markers present — consistent with the SleeperGem trojanized-gem loader (git_credential_manager, Dendreo, fastlane-plugin-run_tests_firebase_testlab) executing its install-time payload on a genuine developer workstation.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1204.003, T1059.001, T1059.004
• Data sources: sysmon, windows_security, edr_process_telemetry
• Severity: high
• Confidence: high

Splunk SPL

index=edr sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" OR sourcetype="linux:sysmon" EventCode=1
| eval parent_is_ruby=if(match(lower(ParentImage), "/ruby(\.exe)?$"), 1, 0)
| where parent_is_ruby=1
| eval child_is_shell=if(match(lower(Image), "(powershell\.exe|cmd\.exe|/bin/sh|/bin/bash)$"), 1, 0)
| where child_is_shell=1
| lookup ci_cd_env_allowlist envvar_present OUTPUT is_ci_runner
| where isnull(is_ci_runner) OR is_ci_runner=0
| stats count min(_time) as first_seen max(_time) as last_seen by host, User, ParentImage, Image, CommandLine
| where count > 0
| sort -last_seen

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName has_any ("ruby", "ruby.exe")
| where FileName has_any ("powershell.exe", "cmd.exe", "sh", "bash")
| where isempty(tostring(parse_json(InitiatingProcessCommandLine)))
| extend CI_Marker = iff(ProcessCommandLine has_any ("GITHUB_ACTIONS","GITLAB_CI","CIRCLECI","JENKINS_URL","VERCEL"), true, false)
| where CI_Marker == false
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, FileName, ProcessCommandLine
| order by Timestamp desc

Sigma

title: RubyGems Require-Time Child Process Spawning Installer Shell (SleeperGem)
id: 3a2c1e40-6b8d-4a2f-9c1e-tl2026sig001
status: experimental
description: Detects a Ruby process spawning a shell/PowerShell child immediately after gem install, consistent with the SleeperGem trojanized-gem loader executing its second-stage installer on a developer workstation.
references:
    - https://www.aikido.dev/blog/sleepergem-rubygems-supply-chain-attack
    - https://www.stepsecurity.io/blog/sleepergem-compromised-rubygems-drop-persistent-backdoor
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-07-20
tags:
    - attack.execution
    - attack.t1204.003
    - attack.t1059
    - attack.t1059.001
    - attack.t1059.004
    - attack.tool.sleepergem
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith:
            - '\ruby.exe'
            - '/ruby'
    selection_child:
        Image|endswith:
            - '\powershell.exe'
            - '\cmd.exe'
            - '/bin/sh'
            - '/bin/bash'
    filter_ci:
        CommandLine|contains:
            - 'GITHUB_ACTIONS'
            - 'GITLAB_CI'
            - 'CIRCLECI'
            - 'JENKINS_URL'
            - 'VERCEL'
    condition: selection_parent and selection_child and not filter_ci
falsepositives:
    - Legitimate Ruby gem post-install hooks that intentionally shell out (rare; validate against known-good gem publishers)
    - Developer tooling wrappers written in Ruby that launch a shell for interactive setup
level: high

Known false positives:

• Legitimate Ruby gem post-install hooks that shell out for compilation or asset builds

Tuning notes: Build and maintain a CI/CD environment-variable allowlist lookup so genuine ephemeral build agents are excluded; extend the parent-image match list to cover jruby/truffleruby if present in the environment.

• 🔒 SleeperGem — Dual Persistence: Identically-Named systemd User Service + Cron Entry · unlock with TL Creds
• 🔒 SleeperGem — Setuid Root Shell Backdoor Masquerading as ping6 ([indicator]) · unlock with TL Creds
• 🔒 SleeperGem — Sudo/Wheel Group Discovery Immediately Followed by Root Re-Execution · unlock with TL Creds
• 🔒 SleeperGem — Ruby Process TLS-Verification-Disabled Fetch to Forgejo C2 ([indicator]) · unlock with TL Creds
• 🔒 SleeperGem — GCM-Impersonating Daemon Artifact Drop at ~/.local/share/gcm/ · unlock with TL Creds
• 🔒 SleeperGem — Dormant RubyGems Maintainer Account Publishes New Release Impersonating Known Vendor Tool · unlock with TL Creds
• 🔒 SleeperGem — skip_install CI/CD Environment Fingerprint Enumeration · unlock with TL Creds
• 🔒 SleeperGem — PowerShell ExecutionPolicy Bypass Fetching GCM-Named Payload · unlock with TL Creds

Indicators of compromise for SleeperGem RubyGems dormant accounts

As of 2026-07-20, Threadlinqs Intelligence tracks 21 indicators of compromise for TL-2026-1575.

Sample indicators (1 of 21)

• Domain: git[.]disroot[.]org

Defanged, TLP:CLEAR. Full set of 21 indicators: unlock with TL Creds.

How SleeperGem RubyGems dormant accounts works

Between July 18 and July 19, 2026, threat actors published malicious versions of three RubyGems packages to the public RubyGems.org registry in a coordinated software supply-chain attack that researchers at Aikido Security named SleeperGem. The name reflects the campaign's core tradecraft: rather than typosquatting or registering new packages, the attackers hijacked two ordinary RubyGems maintainer accounts that had gone quiet for six to seven years -- accounts that "looked harmless enough to hijack without anyone noticing," per Aikido researcher Charlie Eriksen. Once in control, the attackers pushed new releases of Dendreo (v1.1.3, v1.1.4, last legitimately updated 2020) and fastlane-plugin-run_tests_firebase_testlab (v0.3.2, last legitimately updated 2019), and separately published four new versions of a package named git_credential_manager (v2.8.0-2.8.3) that impersonates Microsoft's official Git Credential Manager tool. The git_credential_manager releases shipped within roughly nine hours across two working sessions: a 24-minute gap between v2.8.0 and v2.8.1, an 8-hour sleep, then a 17-minute gap between v2.8.2 and the final v2.8.3 activation release -- behavior consistent with an operator iterating live against telemetry. The malicious gem was also added as a dependency to at least five downstream packages (Dendreo, fastlane-plugin-run_tests_firebase_testlab, slackHtmlToMarkdown, seo_optimizer, array_fast_methods), and fastlane-plugin-run_tests_firebase_testlab alone carried a total download count of 574,661, giving the campaign a substantial installed footprint despite the packages' age. On require, each trojanized gem spawns a child Ruby process that shells out to an install script. The script disables TLS verification (OpenSSL::SSL::VERIFY_NONE) and issues an HTTPS request with a 'Git' User-Agent to an attacker-controlled Forgejo instance at git.disroot.org under the repository namespace 'git-ecosystem', using the URL pattern https://git.disroot.org/git-ecosystem/#{product}/raw/branch/main. Before doing anything further, the script performs a skip_install check that enumerates roughly 30 environment variables associated with CI/CD platforms -- including GITHUB_ACTIONS, GITLAB_CI, CIRCLECI, plus Travis, Jenkins, and Vercel indicators -- and silently exits if any are present. This is a deliberate anti-analysis and targeting control: the operators want persistent footholds on human-operated developer laptops and long-lived build hosts, not disposable, ephemeral CI runners that would be destroyed at job completion and yield no lasting access. On a genuine developer machine, the loader downloads a second-stage shell script (deploy.sh) and a native binary masquerading as a Git Credential Manager helper (Windows delivery uses PowerShell with -ExecutionPolicy bypass; Unix delivery uses /bin/sh). The binary is copied to ~/.local/share/gcm/git-credential-manager with an accompanying ~/.local/share/gcm/.env configuration file, marked executable, and launched as a resident daemon. Persistence is installed twice -- via a systemd user service and a cron entry, both deliberately labeled 'git-credential-manager' so that removing one persistence mechanism leaves the other intact and silently respawns the daemon on reboot or session start. The malware then probes group membership for sudo or wheel; where passwordless sudo is available it re-executes as root and plants a setuid (mode 6777) copy of the system shell disguised as a networking utility at /usr/local/sbin/ping6, providing a durable, camouflaged root escalation path independent of the original daemon. StepSecurity, running the malicious releases inside their Harden-Runner sandboxing tool, captured and confirmed the full kill chain end-to-end. No CVE or GHSA identifier has been assigned to this campaign as of the current reporting; RubyGems.org and downstream mirrors are the primary distribution vector. Affected users are advised to treat any machine that installed the trojanized gems -- and every credential and secret that touched that machine -- as fully compromised, remove the daemon directory and both persistence mechanisms, hunt for the setuid shell at /usr/local/sbin/ping6, and rotate all credentials.

MITRE ATT&CK techniques by tactic:

Defense Evasion

T1036.003 Rename Legitimate Utilities; T1036.005 Match Legitimate Resource Name or Location; T1497.001 System Checks; T1564.001 Hidden Files and Directories

Persistence

T1053.003 Cron; T1543.002 Systemd Service

Privilege Escalation

T1053.003 Cron; T1548.001 Setuid and Setgid; T1548.003 Sudo and Sudo Caching

Execution

T1059.001 PowerShell; T1059.004 Unix Shell; T1204.003 Malicious Image

Discovery

T1069.001 Local Groups; T1082 System Information Discovery; T1518 Software Discovery

Command and Control

T1071.001 Web Protocols; T1102 Web Service; T1105 Ingress Tool Transfer

Initial Access

T1195.002 Compromise Software Supply Chain; T1199 Trusted Relationship

Impact

T1486 Data Encrypted for Impact

privilege-escalation

T1548.001 Setuid and Setgid

Credential Access

T1552.001 Credentials In Files

Resource Development

T1583.004 Server; T1586 Compromise Accounts; T1608.001 Upload Malware

defense-impairment

T1685 Disable or Modify Tools

Remediation for SleeperGem RubyGems dormant accounts

Patches

• No patched version exists; the underlying packages were never legitimate -- affected versions must be fully removed, not upgraded

Immediate actions

• Treat any machine that installed git_credential_manager (2.8.0-2.8.3), Dendreo (1.1.3, 1.1.4), or fastlane-plugin-run_tests_firebase_testlab (0.3.2) as fully compromised
• Remove the dropped daemon and configuration at ~/.local/share/gcm/ (git-credential-manager binary and .env file)
• Kill and remove the systemd user service named 'git-credential-manager' (both the unit file and running process)
• Inspect crontab for the 'git-credential-manager' entry and remove it -- do not stop at removing only one of the two persistence mechanisms
• Hunt for and delete the setuid (mode 6777) root shell backdoor disguised at /usr/local/sbin/ping6
• Block outbound access to git.disroot.org/git-ecosystem/* at the network egress layer pending full incident review
• Rotate all credentials, tokens, and secrets that were present on or accessible from the affected machine, including Git/CI/CD credentials

Workarounds

• Pin RubyGems dependencies to previously known-good versions and disable automatic minor/patch updates for these package names pending registry remediation

Longer-term hardening

• Deploy dependency-confusion and typosquat/impersonation monitoring for developer tooling package names (e.g. git_credential_manager) across all package ecosystems in use
• Adopt allow-listed, pinned, and hash-verified dependency installation for build and developer environments
• Monitor for anomalous outbound connections from developer laptops to code-forge/Forgejo/Gitea hosts not used by the organization
• Require MFA and activity-based re-verification for package maintainer accounts, especially long-dormant ones, at the registry level (RubyGems.org)
• Run untrusted or newly-installed developer tooling gems under sandboxed/Harden-Runner-style execution before general rollout

Affected and fixed versions

• RubyGems.org (community package registry) — git_credential_manager (malicious/impersonating gem)
  Vulnerable versions: 2.8.0; 2.8.1; 2.8.2; 2.8.3
• RubyGems.org (community package registry) — Dendreo
  Vulnerable versions: 1.1.3; 1.1.4
• RubyGems.org (community package registry) — fastlane-plugin-run_tests_firebase_testlab
  Vulnerable versions: 0.3.2

Timeline of SleeperGem RubyGems dormant accounts

• 2017-10-14 locked-ioc-19 gem originally published to RubyGems.org as a legitimate package.
• 2018-02-06 locked-ioc-4 originally published to RubyGems.org, maintained by account 'locked-ioc-18'.
• 2019-03-09 locked-ioc-4 receives its last legitimate update before going dormant for years.
• 2020-10-24 locked-ioc-19 receives its last legitimate update before going dormant.
• 2026-07-18 The Hacker News publishes public reporting summarizing the SleeperGem campaign for a general security audience.
• 2026-07-18 locked-ioc-10 v2.8.1 published approximately 24 minutes after v2.8.0.
• 2026-07-18 First malicious version (locked-ioc-10 v2.8.0) published to RubyGems.org, impersonating Microsoft's official Git Credential Manager tool.
• 2026-07-19 locked-ioc-10 v2.8.3 published 17 minutes after v2.8.2, believed to be the final activation release; locked-ioc-19 v1.1.3/v1.1.4 and locked-ioc-4 v0.3.2 also pushed via the two hijacked dormant maintainer accounts during this window.
• 2026-07-19 locked-ioc-10 v2.8.2 published following an approximately 8-hour operator sleep period.
• 2026-07-20 Aikido Security researcher Charlie Eriksen publicly discloses and names the campaign 'SleeperGem', detailing the dormant-account-hijacking tradecraft.
• 2026-07-20 StepSecurity publishes detailed technical kill-chain analysis after running the malicious releases under its Harden-Runner sandbox.

Sources cited for SleeperGem RubyGems dormant accounts

• SleeperGem: Compromised git_credential_manager, Dendreo, and fastlane RubyGems Drop a Persistent Backdoor stepsecurity.io · Vendor report · 2026-07-20
• SleeperGem: RubyGems supply chain attack targets dormant maintainer accounts aikido.dev · Vendor report · 2026-07-20
• SleeperGem Uses Three Malicious RubyGems Packages to Backdoor Developer Machines The Hacker News · News · 2026-07-18
• SleeperGem RubyGems attack evades CI to hit developer laptops developer-tech.com · News · 2026-07-20
• SleeperGem attack targets Ruby ecosystem with malicious gems scworld.com · News · 2026-07-20
• Supply Chain Vulnerability in RubyGems Highlights Growing Software Security Risks tipranks.com · News · 2026-07-20

Threats related to SleeperGem RubyGems dormant accounts

• SleeperGem: RubyGems Supply Chain Attack Uses Hijacked Dormant Maintainer Accounts to Weaponize git_credential_manager, Dendreo, and fastlane-plugin-run_tests_firebase_testlab
• SleeperGem: Compromised RubyGems Packages (git_credential_manager, Dendreo, fastlane-plugin-run_tests_firebase_testlab) Drop Persistent Multi-Stage Backdoor via Dormant Maintainer Accounts
• SleeperGem: RubyGems Supply Chain Attack via Compromised Dormant Maintainer Accounts
• AsyncAPI npm Supply Chain Attack: Pwn-Request GitHub Actions Compromise Deploys Miasma Tasking Framework
• jscrambler npm Package Supply Chain Compromise (v8.14.0 Malicious Release)

Related coverage of this activity

• SleeperGem RubyGems developer persistence
• JDownloader installer hack
• Miasma 57-package npm worm

Previous and next in supply chain

• ViteVenom: Blockchain-C2 npm Supply Chain Malware Targets Vite Ecosystem (Sequel to ChainVeil, PolinRider Cluster) Previous report
• CodeTracer: Forensic Attribution Tool for Backdoored AI Code-Completion Models Next report

Further reading

• TeamPCP Supply Chain Attack on Trivy, LiteLLM
• Axios Supply Chain Attack: Cross-Platform RATs
• npm Supply Chain Attacks 2026: 218 Packages