SleeperGem: Compromised git_credential_manager, Dendreo, and fastlane RubyGems Drop a Persistent Backdoor

SleeperGem: Compromised git_credential_manager, Dendreo, and (TL-2026-2497), also tracked as SleeperGem, is a critical-severity supply-chain compromise, first published 2026-09-14. It has no confirmed attribution, affects LR-DEV (RubyGems.org account; gem now yanked by, maps to 9 MITRE ATT&CK techniques (T1036.005, T1053.003, T1059.001), and is covered by 9 detection rules and 16 indicators of compromise.

Key facts for TL-2026-2497

Threat ID
TL-2026-2497
Also known as
SleeperGem
Severity
CRITICAL
Status
ACTIVE
Category
SUPPLY_CHAIN
First published
2026-09-14
Last reviewed
2026-09-14
Attribution confidence
LOW
Motivation
UNKNOWN
Target sectors
technology
Detection rules
9
Indicators of compromise
16

Malware and tooling in SleeperGem: Compromised git_credential_manager, Dendreo, and

Malware and tooling: Ruby, SleeperGem, Bundler cooldown source option (Bundler 4.0.13+)

Between July 18-19, 2026, attackers reactivated two long-dormant RubyGems maintainer accounts to publish four malicious git_credential_manager releases plus tampered Dendreo and fastlane-plugin-run_tests_firebase_testlab versions. On `require`, the loader fetches deploy.sh and a native binary from an abused public Forgejo host (git.disroot.org), installs systemd + cron persistence, and attempts a setuid-root privilege escalation at /usr/local/sbin/ping6, while silently exiting on ~30 CI platforms to target developer laptops directly.

How SleeperGem: Compromised git_credential_manager, Dendreo, and works

SleeperGem, named and first disclosed by Aikido Security researcher Charlie Eriksen on July 19, 2026 (report updated July 22, 2026), is a supply-chain compromise of the RubyGems.org registry. The attacker reactivated two unrelated, long-dormant maintainer accounts within hours of each other: the account behind fastlane-plugin-run_tests_firebase_testlab (last legitimate publish March 9, 2019; 574,661+ lifetime downloads) and the account(s) behind Dendreo (last legitimate publish October 24, 2020). The `git_credential_manager` gem itself is new -- a package created from scratch to impersonate the official Microsoft/git-ecosystem Git Credential Manager tool, with its RubyGems.org owner account recorded as "LR-DEV" (confirmed on the now-yanked gem's registry page). Four versions of git_credential_manager (2.8.0-2.8.3) were published July 18-19, 2026, iterating roughly every few hours: 2.8.0/2.8.1 established the install-time dropper (2.8.1 additionally piped installer output to /dev/null to suppress console noise), 2.8.2 moved the payload trigger into the gem's load path so a bare `require` -- not just `gem install` -- fires the loader, and 2.8.3 activated the full detonation chain that had been present-but-commented-out in 2.8.2. Dendreo (1.1.3, 1.1.4) and fastlane-plugin-run_tests_firebase_testlab (0.3.2) shipped the same loader logic riding on the trust of their pre-existing, widely-depended-upon package names.

On trigger, the loader spawns a child Ruby process (bin/install) that reaches out over HTTPS to a public, legitimate Forgejo code-hosting instance at git.disroot.org (URL pattern https://git.disroot.org/git-ecosystem/{product}/raw/branch/main) with TLS certificate verification explicitly disabled (OpenSSL::SSL::VERIFY_NONE) and the User-Agent spoofed as "Git". From there it downloads a shell installer (deploy.sh, executed via /bin/sh on Unix or a PowerShell payload with -ExecutionPolicy bypass on Windows) and a native binary masquerading as the Git Credential Manager tool. The Forgejo host itself is not attacker-owned infrastructure -- it is a legitimate free code-hosting provider being abused to stage payloads, which is why threat-intel infrastructure correlation (BeaconBeagle) returns no dedicated malicious C2 record for the domain.

Before doing anything else, the payload enumerates roughly 30 environment variables associated with CI/CD platforms (GITHUB_ACTIONS, GITLAB_CI, CIRCLECI, and variables associated with Travis CI, Jenkins, and Vercel are confirmed among them) and exits silently if any are present, ensuring the malware only detonates on developer workstations and is never observed on ephemeral, heavily-monitored build runners. On a real target, the binary is dropped to ~/.local/share/gcm/git-credential-manager with a companion ~/.local/share/gcm/.env configuration file, launched as a background daemon, and given two redundant persistence mechanisms: a systemd --user service and a cron entry, both named identically to the legitimate tool ("git-credential-manager"). The malware then probes the user's sudo and wheel group membership; if passwordless sudo is available, it re-executes itself as root and plants a setuid-root (mode 6777) copy of the system shell at /usr/local/sbin/ping6 -- a path deliberately chosen to look like a legitimate networking utility rather than an obvious backdoor.

RubyGems.org's security team yanked all malicious versions by July 21, 2026, capping total public exposure at roughly three days. Notably, Bundler 4.0.13 had shipped a "cooldown" feature (source "https://rubygems.org", cooldown: 7) on June 3, 2026 -- 45 days before the attack -- that delays dependency resolution to newly-published gem versions and fails closed; any project using it would have been completely unaffected. The Hacker News additionally reported that git_credential_manager had already been added as a dependency by at least three unrelated downstream packages (slackHtmlToMarkdown, seo_optimizer, array_fast_methods), creating secondary infection paths beyond direct installation. No CVE or GHSA identifier has been assigned as of this writing; no attribution to a specific threat actor or group has been published by any source.

MITRE ATT&CK techniques used in TL-2026-2497

Defense Evasion

T1036.005 Match Legitimate Resource Name or Location; T1480.001 Environmental Keying

Persistence

T1053.003 Scheduled Task/Job: Cron; T1543.002 Create or Modify System Process: Systemd Service

Execution

T1059.001 Command and Scripting Interpreter: PowerShell; T1059.004 Command and Scripting Interpreter: Unix Shell

Initial Access

T1195.001 Supply Chain Compromise: Compromise Software Dependencies and Development Tools

Privilege Escalation

T1548.001 Abuse Elevation Control Mechanism: Setuid and Setgid; T1548.003 Abuse Elevation Control Mechanism: Sudo and Sudo Caching

Affected products and versions in SleeperGem: Compromised git_credential_manager, Dendreo, and

  • LR-DEV (RubyGems.org account; gem now yanked by rubygems-security-team) — git_credential_manager (RubyGem, impersonating git-ecosystem/git-credential-manager)
    Vulnerable versions: 2.8.0; 2.8.1; 2.8.2; 2.8.3
    Fixed in: No legitimate release exists under this name; package yanked, not patched
  • Dormant RubyGems maintainer account (last legitimate publish 2020-10-24) — Dendreo (RubyGem)
    Vulnerable versions: 1.1.3; 1.1.4
    Fixed in: Versions published before 2026-07-18; malicious releases yanked by rubygems-security-team
  • Dormant RubyGems maintainer account (last legitimate publish 2019-03-09) — fastlane-plugin-run_tests_firebase_testlab (RubyGem)
    Vulnerable versions: 0.3.2
    Fixed in: Versions published before 2026-07-18 (e.g. 0.3.1); malicious release yanked by rubygems-security-team

Remediation for SleeperGem: Compromised git_credential_manager, Dendreo, and

Patches

  • Upgrade to Bundler 4.0.13 or later to gain access to the cooldown feature
  • No legitimate vendor patch exists for these three gems -- remove the malicious versions entirely rather than upgrading in place

Immediate actions

  • Uninstall git_credential_manager (2.8.0-2.8.3), Dendreo (1.1.3-1.1.4), and fastlane-plugin-run_tests_firebase_testlab (0.3.2) if installed, and revert Gemfile.lock to a pre-2026-07-18 version
  • Disable and remove the systemd --user service named git-credential-manager (systemctl --user disable/stop/rm)
  • Remove the matching cron entry that launches the same service name
  • Delete the daemon directory ~/.local/share/gcm/ including the .env configuration file
  • Inspect /usr/local/sbin/ping6 for a setuid-root (mode 6777) shell and remove/restore it if tampered
  • Rotate all credentials reachable from the affected developer machine (git, SSH, cloud, package-registry tokens) -- treat the host as compromised

Workarounds

  • Pin git_credential_manager, Dendreo, and fastlane-plugin-run_tests_firebase_testlab to versions published before 2026-07-18 in Gemfile.lock
  • Block outbound access to git.disroot.org from developer and build environments pending investigation

Longer-term hardening

  • Add Bundler's cooldown source option (e.g. cooldown: 7) to Gemfiles to delay dependency resolution to newly-published gem versions
  • Deploy endpoint/process visibility on developer laptops, historically far less instrumented than CI/CD runners
  • Audit dependency trees for gems added by rarely-updated or newly-reactivated maintainer accounts before upgrading
  • Monitor for gem releases that lack a matching GitHub commit/tag, a common signal of an out-of-band malicious publish
  • Review and restrict passwordless sudo / wheel-group configuration on developer workstations

Weaknesses (CWE) in SleeperGem: Compromised git_credential_manager, Dendreo, and

CWE-506, CWE-494, CWE-295, CWE-269, CWE-732

Timeline of SleeperGem: Compromised git_credential_manager, Dendreo, and

  • fastlane-plugin-run_tests_firebase_testlab's last legitimate publish before its maintainer account was reactivated for the attack; the package had accumulated 574,661+ lifetime downloads by the time it was hijacked.
  • Dendreo's last legitimate publish before its maintainer account was reactivated for the attack.
  • Bundler 4.0.13 ships the 'cooldown' source option, which delays dependency resolution to newly-published gem versions and fails closed -- 45 days before SleeperGem, and would have fully prevented infection had it been adopted.
  • git_credential_manager 2.8.2 moves the payload trigger into the gem's load path so a bare `require` fires the loader; the detonation call itself ships commented out (staging).
  • Attackers publish git_credential_manager 2.8.0 and 2.8.1 (install-time dropper) plus malicious Dendreo 1.1.3/1.1.4 and fastlane-plugin-run_tests_firebase_testlab 0.3.2 to RubyGems.org.
  • Aikido Security researcher Charlie Eriksen publishes the first report naming and detailing the campaign 'SleeperGem'; StepSecurity publishes its own technical writeup the same day.
  • git_credential_manager 2.8.3 uncomments and activates the full loader -> C2 fetch -> daemon -> systemd/cron persistence -> setuid-root escalation chain.
  • The Hacker News, SC Media, developer-tech.com, and Corgea publish follow-on technical coverage and analysis of the campaign.
  • RubyGems.org's security team yanks all malicious versions of git_credential_manager, Dendreo, and fastlane-plugin-run_tests_firebase_testlab, capping public exposure at roughly three days.
  • Aikido Security updates its original SleeperGem report with additional findings.

Sources cited for SleeperGem: Compromised git_credential_manager, Dendreo, and

More in supply chain

Detection coverage for TL-2026-2497

As of 2026-09-14, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2497 across Splunk SPL, Microsoft KQL and Sigma, covering 16 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Further reading

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats