Skip to navigation

Threat reportSupply ChainTL-2026-1703

SleeperGem: RubyGems Supply Chain Attack Uses Hijacked Dormant Maintainer Accounts to Weaponize git_credential_manager, Dendreo, and fastlane-plugin-run_tests_firebase_testlab

highACTIVE

Between July 18-19, 2026, attackers took over at least two RubyGems maintainer accounts dormant since 2019 and published a fake git_credential_manager gem that impersonates Microsoft's official Git Credential Manager, iterating across four releases in nine hours until version 2.8.3 auto-executed a persistent backdoor on a bare `require`.

Key facts for SleeperGem dormant gem takeover

IdentifiersTL-2026-1703
Also known asSleeperGem
SeverityHIGH
Exploitation statusExploited in the wild
Affected productsRubyGems.org (community package) git_credential_manager (RubyGem); RubyGems.org (community package) dendreo (RubyGem); RubyGems.org (community package) fastlane-plugin-run_tests_firebase_testlab (RubyGem)
Weaknesses (CWE)CWE-506, CWE-494, CWE-295, CWE-732, CWE-269
ToolsForgejo
MITRE ATT&CK techniquesT1036.005 Match Legitimate Resource Name or Location, T1053.003 Cron, T1059.001 PowerShell, T1059.004 Unix Shell, T1069.001 Local Groups, T1071.001 Web Protocols, T1082 System Information Discovery, T1102 Web Service, T1105 Ingress Tool Transfer, T1195.001 Compromise Software Dependencies and Development Tools, T1497.001 System Checks, T1543.002 Systemd Service and 5 more in the attack flow
MotivationUNKNOWN
Target sectorstechnology, softwaredevelopment
Target regionsGlobal
Detection rules9 (1 shown free)
Sources11 cited sources

Detection coverage for SleeperGem dormant gem takeover

As of 2026-07-26, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1703 across Splunk SPL, Microsoft KQL and Sigma, covering 25 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Ruby Process Spawning PowerShell with ExecutionPolicy Bypass (SleeperGem Windows Dropper)

Detects a Ruby interpreter process (ruby.exe/rubyw.exe) spawning powershell.exe with -ExecutionPolicy Bypass, matching the SleeperGem git_credential_manager 2.8.0-2.8.3 require-time auto-execute dropper chain that masquerades as Microsoft's official Git Credential Manager and fires the moment the malicious gem is required, with no explicit gem invocation preceding it.

  • Languages: Splunk SPL, Microsoft KQL, Sigma
  • ATT&CK: T1195.001, T1059.001, T1036.005
  • Data sources: sysmon, windows_security, microsoft_defender_for_endpoint
  • Severity: high
  • Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 earliest=-24h
| regex ParentImage="(?i)\\\\ruby(w)?\\.exe$"
| regex Image="(?i)\\\\powershell\\.exe$"
| regex CommandLine="(?i)-executionpolicy\s+bypass"
| eval masquerade_flag=if(match(CommandLine, "(?i)git.?credential.?manager|git-ecosystem|disroot"), "confirmed_ioc_match", "pattern_match_only")
| table _time, ComputerName, User, ParentImage, ParentCommandLine, Image, CommandLine, masquerade_flag
| sort -_time

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName in~ ("ruby.exe","rubyw.exe","ruby")
| where FileName =~ "powershell.exe"
| where ProcessCommandLine has "-ExecutionPolicy" and ProcessCommandLine has "Bypass"
| extend MasqueradeFlag = iff(ProcessCommandLine has_any ("git_credential_manager","git-ecosystem","disroot"), "confirmed_ioc_match", "pattern_match_only")
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, MasqueradeFlag
| order by Timestamp desc

Sigma

title: Ruby Process Spawning PowerShell with ExecutionPolicy Bypass (SleeperGem Dropper Pattern)
id: 4f1a2c3e-6b7d-4e2a-9c1f-8a0d5e3b7c11
status: experimental
description: Detects a Ruby interpreter process spawning powershell.exe with -ExecutionPolicy Bypass, matching the SleeperGem git_credential_manager require-time auto-execute dropper chain.
references:
    - https://www.aikido.dev/blog/sleepergem-rubygems-supply-chain-attack
    - https://www.stepsecurity.io/blog/sleepergem-compromised-rubygems-drop-persistent-backdoor
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-07-26
tags:
    - attack.execution
    - attack.t1195.001
    - attack.t1059.001
    - attack.defense-evasion
    - attack.t1036.005
    - attack.tool.sleepergem
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith:
            - '\ruby.exe'
            - '\rubyw.exe'
    selection_child:
        Image|endswith: '\powershell.exe'
        CommandLine|contains|all:
            - '-ExecutionPolicy'
            - 'Bypass'
    condition: selection_parent and selection_child
falsepositives:
    - Legitimate Ruby-based DevOps tooling (Chef, Puppet, Vagrant, Bundler hooks) that intentionally shells out to PowerShell with a bypass policy for automation
level: high

Known false positives:

  • Legitimate Ruby DevOps tooling (Chef/Puppet/Vagrant/Bundler hooks) that intentionally shells out to PowerShell with -ExecutionPolicy Bypass for automation
  • Internal Ruby build scripts calling PowerShell for Windows-specific setup steps

Tuning notes: Allow-list known-legitimate parent Ruby script paths/hashes used by internal DevOps automation; escalate to critical automatically when masquerade_flag=confirmed_ioc_match (command line contains git_credential_manager/git-ecosystem/disroot).

8 more detection rules (Splunk SPL, Microsoft KQL, Sigma) · unlock with TL Creds. Sign up free to unlock the detection rules or query them with the Threadlinqs MCP server (Purple)
  • Ruby Process Spawning Unix Shell with Masquerading [indicator] Artifact · unlock with TL Creds
  • SleeperGem [indicator] Launch or Cron Persistence Write · unlock with TL Creds
  • TLS Certificate Validation Bypass Prior to Second-Stage Payload Download · unlock with TL Creds
  • Gem Install Followed by Immediate Outbound Network Connection (SleeperGem Require-Time Pattern) · unlock with TL Creds
  • Passwordless-Sudo Discovery Followed by Setuid Backdoor at [indicator] · unlock with TL Creds
  • Ingress Tool Transfer from Public Forgejo Web Service via git-ecosystem Namespace · unlock with TL Creds
  • SleeperGem Relocated Persistence Directory or Systemd User Unit Creation · unlock with TL Creds
  • Outbound Connection to [indicator] Forgejo Staging Host with Bare 'Git' User-Agent · unlock with TL Creds

Indicators of compromise for SleeperGem dormant gem takeover

As of 2026-07-26, Threadlinqs Intelligence tracks 25 indicators of compromise for TL-2026-1703.

Sample indicators (1 of 25)

  • Domain: git[.]disroot[.]org

Defanged, TLP:CLEAR. Full set of 25 indicators: unlock with TL Creds.

25 indicators of compromise · unlock with TL Creds. Compare plans

How SleeperGem dormant gem takeover works

The gem was then added as a dependency of five other dormant gems (dendreo, fastlane-plugin-run_tests_firebase_testlab, slackHtmlToMarkdown, seo_optimizer, array_fast_methods) to reach their existing install bases, while the malware's ~30-variable CI/CD fingerprint check deliberately steered the attack away from build servers and onto developer laptops.

SleeperGem is a RubyGems software-supply-chain campaign, first reported by Wiz Threats and independently analyzed by Aikido Security and StepSecurity, in which attackers compromised long-inactive RubyGems maintainer accounts (dormant since 2019) rather than compromising infrastructure or exploiting a code vulnerability. Using this access, they published a brand-new gem named `git_credential_manager` that impersonates the real, widely-trusted Microsoft Git Credential Manager tool by name alone.

Over a nine-hour window on July 18-19, 2026, the attackers iterated the gem through four published versions, progressively weaponizing it: 2.8.0 was a working dropper that used `Process.spawn` to invoke `powershell -ExecutionPolicy bypass` on Windows or `/bin/sh` on Unix after fetching a payload; 2.8.1 suppressed Unix console output to reduce the chance a developer would notice; 2.8.2 relocated the malicious call into the gem's `require()` load path but left the execution line staged/commented out; and 2.8.3 removed that safety, so the full attack chain now fires automatically the moment any Ruby process merely requires the library, with no explicit `gem install` or invocation needed.

Technically, the loader constructs download URLs of the form `https://git.disroot.org/git-ecosystem/{product}/raw/branch/main` against a public Forgejo (self-hosted Git service) instance, using a deceptive account named `git-ecosystem` to appear ecosystem-adjacent rather than attacker-owned. Before downloading, the code sets `http.verify_mode = OpenSSL::SSL::VERIFY_NONE`, explicitly disabling TLS certificate validation, and spoofs its User-Agent to the bare string "Git". It fetches a `deploy.sh` shell script and a native binary named identically to the impersonated tool. `deploy.sh` copies the binary to `~/.local/share/gcm/git-credential-manager`, makes it executable, drops a config file at `~/.local/share/gcm/.env`, and launches it with a `--daemon` flag - deliberately relocating the payload outside the gem's own install directory so a simple `gem uninstall` does not remove it. Persistence is established redundantly via a systemd `--user` service unit named `git-credential-manager` and a matching cron entry. The malware also probes sudo/wheel group membership; where passwordless sudo is available it re-executes as root and plants a setuid (mode 6777) backdoor shell at `/usr/local/sbin/ping6`.

Before fetching or executing anything, the second stage checks roughly 30 environment variables associated with CI/CD platforms (GitHub Actions, GitLab CI, CircleCI, Travis CI, Jenkins, Vercel) and exits immediately if any are present - a deliberate design choice to avoid detection on short-lived, monitored build infrastructure and instead persist on long-lived developer workstations where secrets (SSH keys, cloud/API tokens, Git credentials, browser session material) accumulate over time.

To spread beyond direct installs of the fake gem, the attackers added `git_credential_manager` as a dependency of five previously-legitimate, long-dormant gems they also controlled: `dendreo` (originally published 2017, republished as 1.1.3/1.1.4), `fastlane-plugin-run_tests_firebase_testlab` (originally published 2018, ~574,661 cumulative downloads, republished as 0.3.2, maintainer account `pinkroom`), and three further packages - `slackHtmlToMarkdown`, `seo_optimizer`, and `array_fast_methods` (maintainer account `LR-DEV`, which controlled four of the five dependent gems). This let the malicious code reach each package's existing downstream users through an ordinary dependency-version bump rather than requiring a direct, conspicuous install of an unfamiliar package.

The malicious releases were yanked from RubyGems.org following disclosure. No CVE, GHSA, or OSV identifier had been assigned as of this research, and no threat actor has been publicly attributed; researchers (notably Aikido's Charlie Eriksen) frame the core innovation as targeting accounts dormant for 6-7 years specifically because such accounts appear unthreatening to registry operators and consumers alike, while still retaining full publish rights.

MITRE ATT&CK techniques by tactic:

Defense Evasion

T1036.005 Match Legitimate Resource Name or Location; T1497.001 System Checks

Persistence

T1053.003 Cron; T1543.002 Systemd Service

Execution

T1059.001 PowerShell; T1059.004 Unix Shell

Discovery

T1069.001 Local Groups; T1082 System Information Discovery

Command and Control

T1071.001 Web Protocols; T1102 Web Service; T1105 Ingress Tool Transfer

Initial Access

T1195.001 Compromise Software Dependencies and Development Tools

Privilege Escalation

T1548.001 Setuid and Setgid; T1548.003 Sudo and Sudo Caching

defense-impairment

T1553 Subvert Trust Controls

Resource Development

T1583.006 Web Services; T1586 Compromise Accounts

Remediation for SleeperGem dormant gem takeover

Patches

  • No vendor patch applies - remediation is removal of the malicious gem versions (git_credential_manager 2.8.0-2.8.3; the compromised dendreo 1.1.3-1.1.4 and fastlane-plugin-run_tests_firebase_testlab 0.3.2 releases), which have been yanked from RubyGems.org

Immediate actions

  • Uninstall git_credential_manager (2.8.0-2.8.3), dendreo (1.1.3-1.1.4), and fastlane-plugin-run_tests_firebase_testlab (0.3.2) from any affected Ruby/Bundler environment; audit Gemfile.lock across all repos for these gems and for slackHtmlToMarkdown, seo_optimizer, and array_fast_methods pulling in git_credential_manager as a dependency
  • Treat any workstation that installed or merely `require`d the malicious gem versions as fully compromised, given 2.8.3's auto-execute-on-require behavior
  • Remove the dropped daemon and persistence: delete ~/.local/share/gcm/ (binary + .env config), disable and remove the systemd --user unit named git-credential-manager, and remove the matching cron entry
  • Inspect /usr/local/sbin/ping6 for an unauthorized setuid (mode 6777) shell and remove it if present; treat its presence as confirmation of successful root privilege escalation
  • Block and retroactively hunt for outbound connections to git.disroot.org, particularly HTTPS requests with disabled certificate validation and a bare 'Git' User-Agent, and for the process pattern `ruby .../git_credential_manager-2.8.3/bin/install -> /bin/sh .../deploy.sh`

Workarounds

  • Pin Gemfile/Gemfile.lock to known-good, pre-compromise gem versions and disable automatic minor/patch version bumps for third-party gems until re-verified
  • Use vendored/local gem caches with `bundle install --local` in CI to avoid unexpectedly pulling newly-published gem versions

Longer-term hardening

  • Rotate all credentials reachable from any affected workstation: SSH keys, Git/GitHub/GitLab tokens, cloud provider credentials, package-registry publish tokens, and browser session material
  • Audit RubyGems.org (and other registry) account activity for dormant/inactive maintainer accounts on gems your organization depends on; require MFA and gem push OTP/API-key scoping for publishing
  • Adopt Software Composition Analysis (SCA) tooling that flags newly-added or first-seen transitive dependencies, especially when a rarely-updated gem suddenly gains a new, unrelated dependency
  • Establish a policy of reviewing diffs on version bumps for dormant or rarely-updated third-party gems before allowing them into CI/CD or developer environments

Affected and fixed versions

  • RubyGems.org (community package) — git_credential_manager (RubyGem)
    Vulnerable versions: 2.8.0; 2.8.1; 2.8.2; 2.8.3
    Fixed in: N/A - entire gem is malicious/impersonating Microsoft Git Credential Manager; package yanked from RubyGems.org, no legitimate release exists under this gem name
  • RubyGems.org (community package) — dendreo (RubyGem)
    Vulnerable versions: 1.1.3; 1.1.4
    Fixed in: Revert to pre-2026-07-18 legitimate releases and verify checksums; malicious releases yanked from RubyGems.org
  • RubyGems.org (community package) — fastlane-plugin-run_tests_firebase_testlab (RubyGem)
    Vulnerable versions: 0.3.2 (compromised republish)
    Fixed in: Revert to pre-2026-07-18 legitimate release and verify checksums; malicious release yanked from RubyGems.org

Timeline of SleeperGem dormant gem takeover

  • locked-ioc-23 gem versions 1.1.3/1.1.4 - later hijacked and weaponized - are originally published as legitimate releases.
  • locked-ioc-6 v0.3.2 - later hijacked and weaponized - is originally published as a legitimate release; the gem accumulates roughly 574,661 downloads before compromise.
  • RubyGems maintainer accounts later hijacked in this campaign go inactive; sources describe them as dormant since 2019 prior to takeover (year-level precision per Wiz Threats).
  • locked-ioc-13 2.8.1 is published, suppressing Unix console output to reduce the chance a developer notices the dropper running.
  • The dormant locked-ioc-23 gem is republished as versions 1.1.3/1.1.4 with locked-ioc-13 added as a dependency, propagating the malicious loader to locked-ioc-23's existing installed base.
  • Using at least two hijacked dormant RubyGems maintainer accounts, attackers publish locked-ioc-13 2.8.0, a working dropper that spawns locked-ioc-9 (Windows) or /bin/sh (Unix) to run a fetched payload.
  • Wiz Threats publishes its incident summary for the campaign.
  • Aikido Security (researcher Charlie Eriksen) and StepSecurity independently publish technical write-ups identifying and naming the campaign SleeperGem.
  • Malicious gem versions are removed (yanked) from RubyGems.org following disclosure.
  • locked-ioc-6 (maintainer account locked-ioc-22) and three further dormant gems - locked-ioc-16, locked-ioc-19, and locked-ioc-17 (maintainer account locked-ioc-25) - are modified to depend on locked-ioc-13, bringing the total to five compromised dependent packages.
  • locked-ioc-13 2.8.3 is published: the staging safety is removed and the full attack chain auto-executes on a bare require with no explicit install step; this version also establishes systemd/cron persistence and attempts setuid privilege escalation to locked-ioc-14.
  • locked-ioc-13 2.8.2 is published, relocating payload execution into the gem's require() load path, with the execution line still staged/commented out rather than live.
  • Corgea publishes an in-depth technical analysis, including process-chain reconstruction, persistence-mechanism details, and defender hunting/detection commands.
  • The Hacker News and multiple security outlets (SC Media, secnews.gr, developer-tech.com) publish coverage of the campaign.
  • Wiz Threats incident record shows its last update, consistent with ongoing tracking of the campaign as of this research.

Sources cited for SleeperGem dormant gem takeover

Previous and next in supply chain

Further reading

Drafted by the Threadlinqs research pipeline from 11 sources; published ; last updated —.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level

Latest Threats