# SleeperGem: Compromised git_credential_manager, Dendreo, and fastlane RubyGems Drop a Persistent Backdoor

> Between July 18-19, 2026, attackers reactivated two long-dormant RubyGems maintainer accounts to publish four malicious git_credential_manager releases plus tampered Dendreo and fastlane-plugin-run_tests_firebase_testlab versions. On `require`, the loader fetches deploy.sh and a native binary from an abused public Forgejo host (git.disroot.org), installs systemd + cron persistence, and attempts a setuid-root privilege escalation at /usr/local/sbin/ping6, while silently exiting on ~30 CI platforms to target developer laptops directly.

- **Published:** 2026-09-14T00:00:00Z
- **Last reviewed:** 2026-09-14T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2497
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-sleepergem-rubygems-developer-persistence-tl-2026-2497.webp?v=3907a48e (Threadlinqs threat intel: SleeperGem RubyGems Attack: Detection & IOCs (TL-2026-2497) — Critical severity, 16 IOCs, 9 detection rules.)
- **ID:** TL-2026-2497
- **Severity:** CRITICAL
- **Category:** SUPPLY_CHAIN
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 16 (1 shown free below)

## Description

SleeperGem, named and first disclosed by Aikido Security researcher Charlie Eriksen on July 19, 2026 (report updated July 22, 2026), is a supply-chain compromise of the RubyGems.org registry. The attacker reactivated two unrelated, long-dormant maintainer accounts within hours of each other: the account behind fastlane-plugin-run_tests_firebase_testlab (last legitimate publish March 9, 2019; 574,661+ lifetime downloads) and the account(s) behind Dendreo (last legitimate publish October 24, 2020). The `git_credential_manager` gem itself is new -- a package created from scratch to impersonate the official Microsoft/git-ecosystem Git Credential Manager tool, with its RubyGems.org owner account recorded as "LR-DEV" (confirmed on the now-yanked gem's registry page). Four versions of git_credential_manager (2.8.0-2.8.3) were published July 18-19, 2026, iterating roughly every few hours: 2.8.0/2.8.1 established the install-time dropper (2.8.1 additionally piped installer output to /dev/null to suppress console noise), 2.8.2 moved the payload trigger into the gem's load path so a bare `require` -- not just `gem install` -- fires the loader, and 2.8.3 activated the full detonation chain that had been present-but-commented-out in 2.8.2. Dendreo (1.1.3, 1.1.4) and fastlane-plugin-run_tests_firebase_testlab (0.3.2) shipped the same loader logic riding on the trust of their pre-existing, widely-depended-upon package names.

On trigger, the loader spawns a child Ruby process (bin/install) that reaches out over HTTPS to a public, legitimate Forgejo code-hosting instance at git.disroot.org (URL pattern https://git.disroot.org/git-ecosystem/{product}/raw/branch/main) with TLS certificate verification explicitly disabled (OpenSSL::SSL::VERIFY_NONE) and the User-Agent spoofed as "Git". From there it downloads a shell installer (deploy.sh, executed via /bin/sh on Unix or a PowerShell payload with -ExecutionPolicy bypass on Windows) and a native binary masquerading as the Git Credential Manager tool. The Forgejo host itself is not attacker-owned infrastructure -- it is a legitimate free code-hosting provider being abused to stage payloads, which is why threat-intel infrastructure correlation (BeaconBeagle) returns no dedicated malicious C2 record for the domain.

Before doing anything else, the payload enumerates roughly 30 environment variables associated with CI/CD platforms (GITHUB_ACTIONS, GITLAB_CI, CIRCLECI, and variables associated with Travis CI, Jenkins, and Vercel are confirmed among them) and exits silently if any are present, ensuring the malware only detonates on developer workstations and is never observed on ephemeral, heavily-monitored build runners. On a real target, the binary is dropped to ~/.local/share/gcm/git-credential-manager with a companion ~/.local/share/gcm/.env configuration file, launched as a background daemon, and given two redundant persistence mechanisms: a systemd --user service and a cron entry, both named identically to the legitimate tool ("git-credential-manager"). The malware then probes the user's sudo and wheel group membership; if passwordless sudo is available, it re-executes itself as root and plants a setuid-root (mode 6777) copy of the system shell at /usr/local/sbin/ping6 -- a path deliberately chosen to look like a legitimate networking utility rather than an obvious backdoor.

RubyGems.org's security team yanked all malicious versions by July 21, 2026, capping total public exposure at roughly three days. Notably, Bundler 4.0.13 had shipped a "cooldown" feature (source "https://rubygems.org", cooldown: 7) on June 3, 2026 -- 45 days before the attack -- that delays dependency resolution to newly-published gem versions and fails closed; any project using it would have been completely unaffected. The Hacker News additionally reported that git_credential_manager had already been added as a dependency by at least three unrelated downstream packages (slackHtmlToMarkdown, seo_optimizer, array_fast_methods), creating secondary infection paths beyond direct installation. No CVE or GHSA identifier has been assigned as of this writing; no attribution to a specific threat actor or group has been published by any source.

## MITRE ATT&CK

- T1195.001 Supply Chain Compromise: Compromise Software Dependencies and Development Tools
- T1059.004 Command and Scripting Interpreter: Unix Shell
- T1059.001 Command and Scripting Interpreter: PowerShell
- T1543.002 Create or Modify System Process: Systemd Service
- T1053.003 Scheduled Task/Job: Cron
- T1548.003 Abuse Elevation Control Mechanism: Sudo and Sudo Caching
- T1548.001 Abuse Elevation Control Mechanism: Setuid and Setgid
- T1036.005 Match Legitimate Resource Name or Location
- T1480.001 Environmental Keying

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**SleeperGem — Require-Time RubyGem Dropper Execution (git_credential_manager/Dendreo/fastlane)** (`TL-2026-2497-SPL-001`)

Detects a Ruby or gem process spawning a child process (bin/install) that executes deploy.sh or reaches out to the abused Forgejo host git.disroot.org, consistent with the SleeperGem require-time loader in malicious git_credential_manager (2.8.0-2.8.3), Dendreo (1.1.3-1.1.4), and fastlane-plugin-run_tests_firebase_testlab (0.3.2). Fires on a bare `require`, not only `gem install`, matching the 2.8.2+ loader relocation.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1195.001, T1059.004, T1105
- **Data sources:** sysmon, linux_auditd, osquery_process_events
- **Severity:** critical
- **Confidence:** high

### Splunk SPL

```spl
index=endpoint sourcetype IN ("XmlWinEventLog:Microsoft-Windows-Sysmon/Operational","linux:audit","osquery:process_events") (EventCode=1 OR action="exec")
| rename Image as process_path, ParentImage as parent_process_path, CommandLine as command_line
| eval parent_lc=lower(parent_process_path)
| where like(parent_lc, "%ruby%") OR like(parent_lc, "%gem%")
| where match(command_line, "(?i)bin/install") OR match(command_line, "(?i)deploy\.sh") OR match(command_line, "(?i)git\.disroot\.org") OR match(command_line, "(?i)(git_credential_manager|dendreo|fastlane-plugin-run_tests_firebase_testlab)")
| stats count earliest(_time) as first_seen latest(_time) as last_seen values(command_line) as command_lines by host, user, parent_process_path, process_path
| where count > 0
```

### Microsoft KQL

```kql
DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName in~ ("ruby", "ruby.exe", "gem", "gem.cmd")
| where ProcessCommandLine has_any ("bin/install", "deploy.sh", "git.disroot.org", "git_credential_manager", "dendreo", "fastlane-plugin-run_tests_firebase_testlab")
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine
| order by Timestamp desc
```

### Sigma

```yaml
title: RubyGem SleeperGem Require-Time Dropper Execution
id: 7a4e1c92-3f5d-4b8a-9e6f-2d1c8a0b4f31
status: experimental
description: Detects a Ruby/gem process spawning bin/install or a shell that references deploy.sh or the abused Forgejo host git.disroot.org, consistent with the SleeperGem require-time loader.
references:
  - https://www.aikido.dev/blog/sleepergem-rubygems-supply-chain-attack
  - https://thehackernews.com/2026/07/sleepergem-uses-three-malicious.html
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-09-14
tags:
  - attack.initial-access
  - attack.t1195.001
  - attack.execution
  - attack.t1059.004
  - attack.tool.sleepergem
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|contains:
      - 'ruby'
      - 'gem'
  selection_indicator:
    CommandLine|contains:
      - 'bin/install'
      - 'deploy.sh'
      - 'git.disroot.org'
      - 'git_credential_manager'
      - 'dendreo'
      - 'fastlane-plugin-run_tests_firebase_testlab'
  condition: selection_parent and selection_indicator
falsepositives:
  - Legitimate CI pipelines building or testing the real fastlane/Dendreo/gcm gems (rare on developer laptops; the malware itself exits on ~30 CI env vars)
  - Internal mirrors or forks that legitimately vendor a file literally named deploy.sh under a ruby-invoked path
level: critical
```

**Known false positives:**

- Legitimate developer or CI workflow that happens to invoke a script literally named deploy.sh from a ruby-spawned child process

**Tuning notes:** Scope to developer-laptop asset groups (exclude confirmed CI/build-runner hosts) to cut noise; add an explicit allowlist for internal gem mirrors that legitimately ship a deploy.sh.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- SleeperGem — Malicious Gem Install/Require Command-Line Indicators (locked: unlock with TL Creds)
- SleeperGem — Passwordless-Sudo Probe and Setuid-Root ping6 Backdoor (locked: unlock with TL Creds)
- SleeperGem — PowerShell Detonation Chain (Windows Variant) (locked: unlock with TL Creds)
- SleeperGem — TLS-Bypassed Ingress Tool Transfer from [indicator] (locked: unlock with TL Creds)
- SleeperGem — Backdoor Daemon Dropped to ~/.local/share/gcm/ (locked: unlock with TL Creds)
- SleeperGem — Downstream Secondary-Infection Package Dependency Pull (locked: unlock with TL Creds)
- SleeperGem — Duplicate systemd/cron Persistence Named 'git-credential-manager' (locked: unlock with TL Creds)
- SleeperGem — CI-Evasion Guardrail Bypass: Daemon Beacon Only Fires Off-CI (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (1 of 16)

Defanged, TLP:CLEAR.

- Domain: `git[.]disroot[.]org`

Full set of 16 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [SleeperGem: RubyGems supply chain attack targets dormant maintainer accounts](https://www.aikido.dev/blog/sleepergem-rubygems-supply-chain-attack)
- [SleeperGem: Compromised git_credential_manager, Dendreo, and fastlane RubyGems Drop a Persistent Backdoor](https://www.stepsecurity.io/blog/sleepergem-compromised-rubygems-drop-persistent-backdoor)
- [SleeperGem: hijacked dormant RubyGems accounts turned require into a persistent developer backdoor](https://corgea.com/research/sleepergem-rubygems-dormant-maintainer-backdoor-july-2026)
- [SleeperGem Uses Three Malicious RubyGems Packages to Target Developer Machines](https://thehackernews.com/2026/07/sleepergem-uses-three-malicious.html)
- [SleeperGem attack targets Ruby ecosystem with malicious gems](https://www.scworld.com/brief/sleepergem-attack-targets-ruby-ecosystem-with-malicious-gems)
- [SleeperGem RubyGems attack evades CI to hit developer laptops](https://www.developer-tech.com/news/sleepergem-rubygems-attack-evades-ci-to-hit-developer-laptops/)
- [Ruby shipped the fix for SleeperGem 45 days before it happened (Bundler cooldown)](https://dev.to/svyatov/ruby-shipped-the-fix-for-sleepergem-45-days-before-it-happened-19dh)
- [git_credential_manager gem page (yanked by rubygems-security-team)](https://rubygems.org/gems/git_credential_manager)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2497