SleeperGem: Compromised git_credential_manager, Dendreo, and fastlane RubyGems Drop a Persistent Backdoor

Key facts for SleeperGem RubyGems developer persistence

Detection coverage for SleeperGem RubyGems developer persistence

As of 2026-09-14, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2497 across Splunk SPL, Microsoft KQL and Sigma, covering 16 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: SleeperGem — Require-Time RubyGem Dropper Execution (git_credential_manager/Dendreo/fastlane)

Detects a Ruby or gem process spawning a child process (bin/install) that executes deploy.sh or reaches out to the abused Forgejo host git.disroot.org, consistent with the SleeperGem require-time loader in malicious git_credential_manager (2.8.0-2.8.3), Dendreo (1.1.3-1.1.4), and fastlane-plugin-run_tests_firebase_testlab (0.3.2). Fires on a bare `require`, not only `gem install`, matching the 2.8.2+ loader relocation.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1195.001, T1059.004, T1105
• Data sources: sysmon, linux_auditd, osquery_process_events
• Severity: critical
• Confidence: high

Splunk SPL

index=endpoint sourcetype IN ("XmlWinEventLog:Microsoft-Windows-Sysmon/Operational","linux:audit","osquery:process_events") (EventCode=1 OR action="exec")
| rename Image as process_path, ParentImage as parent_process_path, CommandLine as command_line
| eval parent_lc=lower(parent_process_path)
| where like(parent_lc, "%ruby%") OR like(parent_lc, "%gem%")
| where match(command_line, "(?i)bin/install") OR match(command_line, "(?i)deploy\.sh") OR match(command_line, "(?i)git\.disroot\.org") OR match(command_line, "(?i)(git_credential_manager|dendreo|fastlane-plugin-run_tests_firebase_testlab)")
| stats count earliest(_time) as first_seen latest(_time) as last_seen values(command_line) as command_lines by host, user, parent_process_path, process_path
| where count > 0

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName in~ ("ruby", "ruby.exe", "gem", "gem.cmd")
| where ProcessCommandLine has_any ("bin/install", "deploy.sh", "git.disroot.org", "git_credential_manager", "dendreo", "fastlane-plugin-run_tests_firebase_testlab")
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine
| order by Timestamp desc

Sigma

title: RubyGem SleeperGem Require-Time Dropper Execution
id: 7a4e1c92-3f5d-4b8a-9e6f-2d1c8a0b4f31
status: experimental
description: Detects a Ruby/gem process spawning bin/install or a shell that references deploy.sh or the abused Forgejo host git.disroot.org, consistent with the SleeperGem require-time loader.
references:
  - https://www.aikido.dev/blog/sleepergem-rubygems-supply-chain-attack
  - https://thehackernews.com/2026/07/sleepergem-uses-three-malicious.html
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-09-14
tags:
  - attack.initial-access
  - attack.t1195.001
  - attack.execution
  - attack.t1059.004
  - attack.tool.sleepergem
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|contains:
      - 'ruby'
      - 'gem'
  selection_indicator:
    CommandLine|contains:
      - 'bin/install'
      - 'deploy.sh'
      - 'git.disroot.org'
      - 'git_credential_manager'
      - 'dendreo'
      - 'fastlane-plugin-run_tests_firebase_testlab'
  condition: selection_parent and selection_indicator
falsepositives:
  - Legitimate CI pipelines building or testing the real fastlane/Dendreo/gcm gems (rare on developer laptops; the malware itself exits on ~30 CI env vars)
  - Internal mirrors or forks that legitimately vendor a file literally named deploy.sh under a ruby-invoked path
level: critical

Known false positives:

• Legitimate developer or CI workflow that happens to invoke a script literally named deploy.sh from a ruby-spawned child process

Tuning notes: Scope to developer-laptop asset groups (exclude confirmed CI/build-runner hosts) to cut noise; add an explicit allowlist for internal gem mirrors that legitimately ship a deploy.sh.

• 🔒 SleeperGem — Malicious Gem Install/Require Command-Line Indicators · unlock with TL Creds
• 🔒 SleeperGem — Passwordless-Sudo Probe and Setuid-Root ping6 Backdoor · unlock with TL Creds
• 🔒 SleeperGem — PowerShell Detonation Chain (Windows Variant) · unlock with TL Creds
• 🔒 SleeperGem — TLS-Bypassed Ingress Tool Transfer from [indicator] · unlock with TL Creds
• 🔒 SleeperGem — Backdoor Daemon Dropped to ~/.local/share/gcm/ · unlock with TL Creds
• 🔒 SleeperGem — Downstream Secondary-Infection Package Dependency Pull · unlock with TL Creds
• 🔒 SleeperGem — Duplicate systemd/cron Persistence Named 'git-credential-manager' · unlock with TL Creds
• 🔒 SleeperGem — CI-Evasion Guardrail Bypass: Daemon Beacon Only Fires Off-CI · unlock with TL Creds

Indicators of compromise for SleeperGem RubyGems developer persistence

As of 2026-09-14, Threadlinqs Intelligence tracks 16 indicators of compromise for TL-2026-2497.

Sample indicators (1 of 16)

• Domain: git[.]disroot[.]org

Defanged, TLP:CLEAR. Full set of 16 indicators: unlock with TL Creds.

How SleeperGem RubyGems developer persistence works

SleeperGem, named and first disclosed by Aikido Security researcher Charlie Eriksen on July 19, 2026 (report updated July 22, 2026), is a supply-chain compromise of the RubyGems.org registry. The attacker reactivated two unrelated, long-dormant maintainer accounts within hours of each other: the account behind fastlane-plugin-run_tests_firebase_testlab (last legitimate publish March 9, 2019; 574,661+ lifetime downloads) and the account(s) behind Dendreo (last legitimate publish October 24, 2020). The `git_credential_manager` gem itself is new -- a package created from scratch to impersonate the official Microsoft/git-ecosystem Git Credential Manager tool, with its RubyGems.org owner account recorded as "LR-DEV" (confirmed on the now-yanked gem's registry page). Four versions of git_credential_manager (2.8.0-2.8.3) were published July 18-19, 2026, iterating roughly every few hours: 2.8.0/2.8.1 established the install-time dropper (2.8.1 additionally piped installer output to /dev/null to suppress console noise), 2.8.2 moved the payload trigger into the gem's load path so a bare `require` -- not just `gem install` -- fires the loader, and 2.8.3 activated the full detonation chain that had been present-but-commented-out in 2.8.2. Dendreo (1.1.3, 1.1.4) and fastlane-plugin-run_tests_firebase_testlab (0.3.2) shipped the same loader logic riding on the trust of their pre-existing, widely-depended-upon package names.

On trigger, the loader spawns a child Ruby process (bin/install) that reaches out over HTTPS to a public, legitimate Forgejo code-hosting instance at git.disroot.org (URL pattern https://git.disroot.org/git-ecosystem/{product}/raw/branch/main) with TLS certificate verification explicitly disabled (OpenSSL::SSL::VERIFY_NONE) and the User-Agent spoofed as "Git". From there it downloads a shell installer (deploy.sh, executed via /bin/sh on Unix or a PowerShell payload with -ExecutionPolicy bypass on Windows) and a native binary masquerading as the Git Credential Manager tool. The Forgejo host itself is not attacker-owned infrastructure -- it is a legitimate free code-hosting provider being abused to stage payloads, which is why threat-intel infrastructure correlation (BeaconBeagle) returns no dedicated malicious C2 record for the domain.

Before doing anything else, the payload enumerates roughly 30 environment variables associated with CI/CD platforms (GITHUB_ACTIONS, GITLAB_CI, CIRCLECI, and variables associated with Travis CI, Jenkins, and Vercel are confirmed among them) and exits silently if any are present, ensuring the malware only detonates on developer workstations and is never observed on ephemeral, heavily-monitored build runners. On a real target, the binary is dropped to ~/.local/share/gcm/git-credential-manager with a companion ~/.local/share/gcm/.env configuration file, launched as a background daemon, and given two redundant persistence mechanisms: a systemd --user service and a cron entry, both named identically to the legitimate tool ("git-credential-manager"). The malware then probes the user's sudo and wheel group membership; if passwordless sudo is available, it re-executes itself as root and plants a setuid-root (mode 6777) copy of the system shell at /usr/local/sbin/ping6 -- a path deliberately chosen to look like a legitimate networking utility rather than an obvious backdoor.

RubyGems.org's security team yanked all malicious versions by July 21, 2026, capping total public exposure at roughly three days. Notably, Bundler 4.0.13 had shipped a "cooldown" feature (source "https://rubygems.org", cooldown: 7) on June 3, 2026 -- 45 days before the attack -- that delays dependency resolution to newly-published gem versions and fails closed; any project using it would have been completely unaffected. The Hacker News additionally reported that git_credential_manager had already been added as a dependency by at least three unrelated downstream packages (slackHtmlToMarkdown, seo_optimizer, array_fast_methods), creating secondary infection paths beyond direct installation. No CVE or GHSA identifier has been assigned as of this writing; no attribution to a specific threat actor or group has been published by any source.

MITRE ATT&CK techniques by tactic:

Defense Evasion

T1036.005 Match Legitimate Resource Name or Location; T1480.001 Environmental Keying

Persistence

T1053.003 Scheduled Task/Job: Cron; T1543.002 Create or Modify System Process: Systemd Service

Execution

T1059.001 Command and Scripting Interpreter: PowerShell; T1059.004 Command and Scripting Interpreter: Unix Shell

Initial Access

T1195.001 Supply Chain Compromise: Compromise Software Dependencies and Development Tools

Privilege Escalation

T1548.001 Abuse Elevation Control Mechanism: Setuid and Setgid; T1548.003 Abuse Elevation Control Mechanism: Sudo and Sudo Caching

Remediation for SleeperGem RubyGems developer persistence

Patches

• Upgrade to Bundler 4.0.13 or later to gain access to the cooldown feature
• No legitimate vendor patch exists for these three gems -- remove the malicious versions entirely rather than upgrading in place

Immediate actions

• Uninstall git_credential_manager (2.8.0-2.8.3), Dendreo (1.1.3-1.1.4), and fastlane-plugin-run_tests_firebase_testlab (0.3.2) if installed, and revert Gemfile.lock to a pre-2026-07-18 version
• Disable and remove the systemd --user service named git-credential-manager (systemctl --user disable/stop/rm)
• Remove the matching cron entry that launches the same service name
• Delete the daemon directory ~/.local/share/gcm/ including the .env configuration file
• Inspect /usr/local/sbin/ping6 for a setuid-root (mode 6777) shell and remove/restore it if tampered
• Rotate all credentials reachable from the affected developer machine (git, SSH, cloud, package-registry tokens) -- treat the host as compromised

Workarounds

• Pin git_credential_manager, Dendreo, and fastlane-plugin-run_tests_firebase_testlab to versions published before 2026-07-18 in Gemfile.lock
• Block outbound access to git.disroot.org from developer and build environments pending investigation

Longer-term hardening

• Add Bundler's cooldown source option (e.g. cooldown: 7) to Gemfiles to delay dependency resolution to newly-published gem versions
• Deploy endpoint/process visibility on developer laptops, historically far less instrumented than CI/CD runners
• Audit dependency trees for gems added by rarely-updated or newly-reactivated maintainer accounts before upgrading
• Monitor for gem releases that lack a matching GitHub commit/tag, a common signal of an out-of-band malicious publish
• Review and restrict passwordless sudo / wheel-group configuration on developer workstations

Affected and fixed versions

• LR-DEV (RubyGems.org account; gem now yanked by rubygems-security-team) — git_credential_manager (RubyGem, impersonating git-ecosystem/git-credential-manager)
  Vulnerable versions: 2.8.0; 2.8.1; 2.8.2; 2.8.3
  Fixed in: No legitimate release exists under this name; package yanked, not patched
• Dormant RubyGems maintainer account (last legitimate publish 2020-10-24) — Dendreo (RubyGem)
  Vulnerable versions: 1.1.3; 1.1.4
  Fixed in: Versions published before 2026-07-18; malicious releases yanked by rubygems-security-team
• Dormant RubyGems maintainer account (last legitimate publish 2019-03-09) — fastlane-plugin-run_tests_firebase_testlab (RubyGem)
  Vulnerable versions: 0.3.2
  Fixed in: Versions published before 2026-07-18 (e.g. 0.3.1); malicious release yanked by rubygems-security-team

Timeline of SleeperGem RubyGems developer persistence

• 2019-03-09 locked-ioc-4's last legitimate publish before its maintainer account was reactivated for the attack; the package had accumulated 574,661+ lifetime downloads by the time it was hijacked.
• 2020-10-24 locked-ioc-15's last legitimate publish before its maintainer account was reactivated for the attack.
• 2026-06-03 Bundler 4.0.13 ships the 'cooldown' source option, which delays dependency resolution to newly-published gem versions and fails closed -- 45 days before locked-ioc-13, and would have fully prevented infection had it been adopted.
• 2026-07-18 locked-ioc-7 2.8.2 moves the payload trigger into the gem's load path so a bare `require` fires the loader; the detonation call itself ships commented out (staging).
• 2026-07-18 Attackers publish locked-ioc-7 2.8.0 and 2.8.1 (install-time dropper) plus malicious locked-ioc-15 1.1.3/1.1.4 and locked-ioc-4 0.3.2 to RubyGems.org.
• 2026-07-19 Aikido Security researcher Charlie Eriksen publishes the first report naming and detailing the campaign 'locked-ioc-13'; StepSecurity publishes its own technical writeup the same day.
• 2026-07-19 locked-ioc-7 2.8.3 uncomments and activates the full loader -> C2 fetch -> daemon -> systemd/cron persistence -> setuid-root escalation chain.
• 2026-07-20 The Hacker News, SC Media, developer-tech.com, and Corgea publish follow-on technical coverage and analysis of the campaign.
• 2026-07-21 RubyGems.org's security team yanks all malicious versions of locked-ioc-7, locked-ioc-15, and locked-ioc-4, capping public exposure at roughly three days.
• 2026-07-22 Aikido Security updates its original locked-ioc-13 report with additional findings.

Sources cited for SleeperGem RubyGems developer persistence

• git_credential_manager gem page (yanked by rubygems-security-team) rubygems.org · Advisory · 2026-07-21
• SleeperGem: RubyGems supply chain attack targets dormant maintainer accounts aikido.dev · Research · 2026-07-19
• SleeperGem: hijacked dormant RubyGems accounts turned require into a persistent developer backdoor corgea.com · Research · 2026-07-20
• SleeperGem: Compromised git_credential_manager, Dendreo, and fastlane RubyGems Drop a Persistent Backdoor stepsecurity.io · Blog · 2026-07-19
• Ruby shipped the fix for SleeperGem 45 days before it happened (Bundler cooldown) dev.to · Blog · 2026-07-22
• SleeperGem Uses Three Malicious RubyGems Packages to Target Developer Machines The Hacker News · News · 2026-07-20
• SleeperGem attack targets Ruby ecosystem with malicious gems scworld.com · News · 2026-07-20
• SleeperGem RubyGems attack evades CI to hit developer laptops developer-tech.com · News · 2026-07-20

Threats related to SleeperGem RubyGems developer persistence

• SleeperGem: RubyGems Supply Chain Attack Uses Hijacked Dormant Maintainer Accounts to Weaponize git_credential_manager, Dendreo, and fastlane-plugin-run_tests_firebase_testlab
• SleeperGem Supply-Chain Campaign Uses Three Malicious RubyGems Packages to Backdoor Developer Machines

Previous and next in supply chain

• Admin Menu Editor Pro WordPress Plugin Backdoored via Supply-Chain Compromise, 1,500 Sites Affected Next report

Further reading

• TeamPCP Supply Chain Attack on Trivy, LiteLLM
• Axios Supply Chain Attack: Cross-Platform RATs
• npm Supply Chain Attacks 2026: 218 Packages