# SleeperGem: RubyGems Supply Chain Attack Uses Hijacked Dormant Maintainer Accounts to Weaponize git_credential_manager, Dendreo, and fastlane-plugin-run_tests_firebase_testlab

> Between July 18-19, 2026, attackers took over at least two RubyGems maintainer accounts dormant since 2019 and published a fake git_credential_manager gem that impersonates Microsoft's official Git Credential Manager, iterating across four releases in nine hours until version 2.8.3 auto-executed a persistent backdoor on a bare `require`. The gem was then added as a dependency of five other dormant gems (dendreo, fastlane-plugin-run_tests_firebase_testlab, slackHtmlToMarkdown, seo_optimizer, array_fast_methods) to reach their existing install bases, while the malware's ~30-variable CI/CD fingerprint check deliberately steered the attack away from build servers and onto developer laptops.

- **Published:** 2026-07-26T00:00:00Z
- **Last reviewed:** 2026-07-26T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1703
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-sleepergem-dormant-gem-takeover-tl-2026-1703.webp?v=4d5d0a26 (Threadlinqs threat intel: SleeperGem Dormant Account Takeover: Detection & IOCs (TL-2026-1703) — High severity, 25 IOCs, 9 detection rules.)
- **ID:** TL-2026-1703
- **Severity:** HIGH
- **Category:** SUPPLY_CHAIN
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 25 (1 shown free below)

## Description

SleeperGem is a RubyGems software-supply-chain campaign, first reported by Wiz Threats and independently analyzed by Aikido Security and StepSecurity, in which attackers compromised long-inactive RubyGems maintainer accounts (dormant since 2019) rather than compromising infrastructure or exploiting a code vulnerability. Using this access, they published a brand-new gem named `git_credential_manager` that impersonates the real, widely-trusted Microsoft Git Credential Manager tool by name alone.

Over a nine-hour window on July 18-19, 2026, the attackers iterated the gem through four published versions, progressively weaponizing it: 2.8.0 was a working dropper that used `Process.spawn` to invoke `powershell -ExecutionPolicy bypass` on Windows or `/bin/sh` on Unix after fetching a payload; 2.8.1 suppressed Unix console output to reduce the chance a developer would notice; 2.8.2 relocated the malicious call into the gem's `require()` load path but left the execution line staged/commented out; and 2.8.3 removed that safety, so the full attack chain now fires automatically the moment any Ruby process merely requires the library, with no explicit `gem install` or invocation needed.

Technically, the loader constructs download URLs of the form `https://git.disroot.org/git-ecosystem/{product}/raw/branch/main` against a public Forgejo (self-hosted Git service) instance, using a deceptive account named `git-ecosystem` to appear ecosystem-adjacent rather than attacker-owned. Before downloading, the code sets `http.verify_mode = OpenSSL::SSL::VERIFY_NONE`, explicitly disabling TLS certificate validation, and spoofs its User-Agent to the bare string "Git". It fetches a `deploy.sh` shell script and a native binary named identically to the impersonated tool. `deploy.sh` copies the binary to `~/.local/share/gcm/git-credential-manager`, makes it executable, drops a config file at `~/.local/share/gcm/.env`, and launches it with a `--daemon` flag - deliberately relocating the payload outside the gem's own install directory so a simple `gem uninstall` does not remove it. Persistence is established redundantly via a systemd `--user` service unit named `git-credential-manager` and a matching cron entry. The malware also probes sudo/wheel group membership; where passwordless sudo is available it re-executes as root and plants a setuid (mode 6777) backdoor shell at `/usr/local/sbin/ping6`.

Before fetching or executing anything, the second stage checks roughly 30 environment variables associated with CI/CD platforms (GitHub Actions, GitLab CI, CircleCI, Travis CI, Jenkins, Vercel) and exits immediately if any are present - a deliberate design choice to avoid detection on short-lived, monitored build infrastructure and instead persist on long-lived developer workstations where secrets (SSH keys, cloud/API tokens, Git credentials, browser session material) accumulate over time.

To spread beyond direct installs of the fake gem, the attackers added `git_credential_manager` as a dependency of five previously-legitimate, long-dormant gems they also controlled: `dendreo` (originally published 2017, republished as 1.1.3/1.1.4), `fastlane-plugin-run_tests_firebase_testlab` (originally published 2018, ~574,661 cumulative downloads, republished as 0.3.2, maintainer account `pinkroom`), and three further packages - `slackHtmlToMarkdown`, `seo_optimizer`, and `array_fast_methods` (maintainer account `LR-DEV`, which controlled four of the five dependent gems). This let the malicious code reach each package's existing downstream users through an ordinary dependency-version bump rather than requiring a direct, conspicuous install of an unfamiliar package.

The malicious releases were yanked from RubyGems.org following disclosure. No CVE, GHSA, or OSV identifier had been assigned as of this research, and no threat actor has been publicly attributed; researchers (notably Aikido's Charlie Eriksen) frame the core innovation as targeting accounts dormant for 6-7 years specifically because such accounts appear unthreatening to registry operators and consumers alike, while still retaining full publish rights.

## MITRE ATT&CK

- T1583.006 Web Services
- T1586 Compromise Accounts
- T1195.001 Compromise Software Dependencies and Development Tools
- T1059.001 PowerShell
- T1059.004 Unix Shell
- T1543.002 Systemd Service
- T1053.003 Cron
- T1548.003 Sudo and Sudo Caching
- T1548.001 Setuid and Setgid
- T1036.005 Match Legitimate Resource Name or Location
- T1497.001 System Checks
- T1553 Subvert Trust Controls
- T1069.001 Local Groups
- T1082 System Information Discovery
- T1105 Ingress Tool Transfer
- T1071.001 Web Protocols
- T1102 Web Service

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Ruby Process Spawning PowerShell with ExecutionPolicy Bypass (SleeperGem Windows Dropper)** (`TL-2026-1703-SPL-001`)

Detects a Ruby interpreter process (ruby.exe/rubyw.exe) spawning powershell.exe with -ExecutionPolicy Bypass, matching the SleeperGem git_credential_manager 2.8.0-2.8.3 require-time auto-execute dropper chain that masquerades as Microsoft's official Git Credential Manager and fires the moment the malicious gem is required, with no explicit gem invocation preceding it.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1195.001, T1059.001, T1036.005
- **Data sources:** sysmon, windows_security, microsoft_defender_for_endpoint
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 earliest=-24h
| regex ParentImage="(?i)\\\\ruby(w)?\\.exe$"
| regex Image="(?i)\\\\powershell\\.exe$"
| regex CommandLine="(?i)-executionpolicy\s+bypass"
| eval masquerade_flag=if(match(CommandLine, "(?i)git.?credential.?manager|git-ecosystem|disroot"), "confirmed_ioc_match", "pattern_match_only")
| table _time, ComputerName, User, ParentImage, ParentCommandLine, Image, CommandLine, masquerade_flag
| sort -_time
```

### Microsoft KQL

```kql
DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName in~ ("ruby.exe","rubyw.exe","ruby")
| where FileName =~ "powershell.exe"
| where ProcessCommandLine has "-ExecutionPolicy" and ProcessCommandLine has "Bypass"
| extend MasqueradeFlag = iff(ProcessCommandLine has_any ("git_credential_manager","git-ecosystem","disroot"), "confirmed_ioc_match", "pattern_match_only")
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, MasqueradeFlag
| order by Timestamp desc
```

### Sigma

```yaml
title: Ruby Process Spawning PowerShell with ExecutionPolicy Bypass (SleeperGem Dropper Pattern)
id: 4f1a2c3e-6b7d-4e2a-9c1f-8a0d5e3b7c11
status: experimental
description: Detects a Ruby interpreter process spawning powershell.exe with -ExecutionPolicy Bypass, matching the SleeperGem git_credential_manager require-time auto-execute dropper chain.
references:
    - https://www.aikido.dev/blog/sleepergem-rubygems-supply-chain-attack
    - https://www.stepsecurity.io/blog/sleepergem-compromised-rubygems-drop-persistent-backdoor
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-07-26
tags:
    - attack.execution
    - attack.t1195.001
    - attack.t1059.001
    - attack.defense-evasion
    - attack.t1036.005
    - attack.tool.sleepergem
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith:
            - '\ruby.exe'
            - '\rubyw.exe'
    selection_child:
        Image|endswith: '\powershell.exe'
        CommandLine|contains|all:
            - '-ExecutionPolicy'
            - 'Bypass'
    condition: selection_parent and selection_child
falsepositives:
    - Legitimate Ruby-based DevOps tooling (Chef, Puppet, Vagrant, Bundler hooks) that intentionally shells out to PowerShell with a bypass policy for automation
level: high
```

**Known false positives:**

- Legitimate Ruby DevOps tooling (Chef/Puppet/Vagrant/Bundler hooks) that intentionally shells out to PowerShell with -ExecutionPolicy Bypass for automation
- Internal Ruby build scripts calling PowerShell for Windows-specific setup steps

**Tuning notes:** Allow-list known-legitimate parent Ruby script paths/hashes used by internal DevOps automation; escalate to critical automatically when masquerade_flag=confirmed_ioc_match (command line contains git_credential_manager/git-ecosystem/disroot).

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Ruby Process Spawning Unix Shell with Masquerading [indicator] Artifact (locked: unlock with TL Creds)
- SleeperGem [indicator] Launch or Cron Persistence Write (locked: unlock with TL Creds)
- TLS Certificate Validation Bypass Prior to Second-Stage Payload Download (locked: unlock with TL Creds)
- Gem Install Followed by Immediate Outbound Network Connection (SleeperGem Require-Time Pattern) (locked: unlock with TL Creds)
- Passwordless-Sudo Discovery Followed by Setuid Backdoor at [indicator] (locked: unlock with TL Creds)
- Ingress Tool Transfer from Public Forgejo Web Service via git-ecosystem Namespace (locked: unlock with TL Creds)
- SleeperGem Relocated Persistence Directory or Systemd User Unit Creation (locked: unlock with TL Creds)
- Outbound Connection to [indicator] Forgejo Staging Host with Bare 'Git' User-Agent (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (1 of 25)

Defanged, TLP:CLEAR.

- Domain: `git[.]disroot[.]org`

Full set of 25 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [SleeperGem: RubyGems Supply Chain Attack Targets Dormant Maintainer Accounts](https://threats.wiz.io/all-incidents/sleepergem-rubygems-supply-chain-attack-targets-dormant-maintainer-accounts)
- [SleeperGem: RubyGems supply chain attack targets dormant maintainer accounts](https://www.aikido.dev/blog/sleepergem-rubygems-supply-chain-attack)
- [SleeperGem: Compromised git_credential_manager, Dendreo, and fastlane RubyGems Drop a Persistent Backdoor](https://www.stepsecurity.io/blog/sleepergem-compromised-rubygems-drop-persistent-backdoor)
- [SleeperGem: hijacked dormant RubyGems accounts turned `require` into a persistent developer backdoor](https://corgea.com/research/sleepergem-rubygems-dormant-maintainer-backdoor-july-2026)
- [SleeperGem Uses Three Malicious RubyGems Packages to Target Developer Machines](https://thehackernews.com/2026/07/sleepergem-uses-three-malicious.html)
- [SleeperGem attack targets Ruby ecosystem with malicious gems](https://www.scworld.com/brief/sleepergem-attack-targets-ruby-ecosystem-with-malicious-gems)
- [SleeperGem RubyGems attack evades CI to hit developer laptops](https://www.developer-tech.com/news/sleepergem-rubygems-attack-evades-ci-to-hit-developer-laptops/)
- [SleeperGem: Supply Chain Attack via RubyGems](https://www.secnews.gr/en/722385/sleepergem-rubygems-supply-chain-attack/)
- [SleeperGem RubyGems Attack Backdoored Developer Machines via Hijacked Dormant Gems](https://mallory.ai/stories/019f79a2-1d28-725b-9e14-d9c191786265)
- [RST Cloud - SleeperGem threat report thread](https://x.com/rst_cloud/status/2079010592438772098)
- [git-ecosystem/git-credential-manager (legitimate upstream project impersonated by the malicious gem)](https://github.com/git-ecosystem/git-credential-manager)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1703