GemStuffer Campaign Uses RubyGems to Publish Scraped UK Council Data
Summary
Socket researchers identified 155 RubyGems package artifacts that scrape UK council meeting portals and publish the collected pages in gem archives using embedded API credentials. RubyGems says existing accounts, packages, and installs were unaffected by a related spam-
Key points
- The campaign scraped ModernGov democratic-services portals used by Lambeth, Wandsworth, and Southwark, collecting calendars, agenda listings, committee links, and related content.
- It packaged collected responses into valid .gem archives and published them to RubyGems, using either the gem CLI or direct API requests.
- Samples used hardcoded RubyGems API keys; some created a temporary credentials file under /tmp and overrode HOME to publish packages.
- Socket tracked 155 package artifacts and describes the registry as a public data drop; much of the scraped material appears publicly accessible.
- RubyGems said a related coordinated spam-publishing incident involved newly registered accounts, with no existing packages compromised; registration was temporarily disabled and webhooks throttled.
- Recommended actions include yanking identified gems, reviewing potentially affected hosts and Ruby/CI delivery paths, and monitoring or restricting outbound gem publishing.
Article Details
- Attack Vectors
- Ruby scripts scrape hardcoded Lambeth, Wandsworth, and Southwark ModernGov portal URLs, then follow agenda and committee links to collect page content.
- The scripts package scraped responses into .gem archives and publish them to RubyGems using embedded API credentials, either through the gem CLI or direct HTTP POST requests.
- The implant does not self-propagate; the article says it was placed on a machine by another mechanism.
- Defensive Notes
- Yank identified campaign packages and report the package set to RubyGems for removal.
- Audit /tmp for campaign staging directories and credential artifacts; preserve and forensically image matching files before deletion.
- Review Bundler configuration, gem post-install hooks, CI pipeline definitions, and dotfile repositories for references to the listed delivery filenames.
- Alert on production Ruby processes that redirect HOME to /tmp, and block outbound gem pushes where they are not required; restrict permitted gem names in publishing pipelines.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| MD5 | 81c34eea9c853c5ec13a3b3cd4a2228b | MD5 of the listed payload.rb file artifact associated with GemStuffer. |
| MD5 | 9211506ae02c9e4e75aeadfebeb4883c | MD5 of the listed script.rb file artifact associated with GemStuffer. |
| SHA1 | 5f924c0454f1fb6b2299d658c3bb4e75ce3d0b66 | SHA-1 of the listed payload.rb file artifact associated with GemStuffer. |
| SHA1 | db9827ae2c004a4dc6009be2d009477bff5249df | SHA-1 of the listed script.rb file artifact associated with GemStuffer. |
| SHA256 | 239440c830e17530dda0a8a06ed2708860998750a1e3ed2239e919465dc59420 | SHA-256 of the listed payload.rb file artifact associated with GemStuffer. |
| SHA256 | c2d6bcacc88177e0f2c8c262726f86f37e671b1692c8bc135bac4b610ddcf31a | SHA-256 of the listed script.rb file artifact associated with GemStuffer. |
MITRE ATT&CK
T1074.001 · Local Data StagingThe scripts stage scraped council responses and build gem archives in temporary directories before publishing them.T1567.001 · Exfiltration to Code RepositoryThe campaign uses RubyGems as a public package repository to upload archives containing scraped council data for later retrieval.
People
Products
ModernGovThe campaign focuses on public-facing ModernGov portals used by Lambeth, Wandsworth, and Southwark, collecting council calendar pages, agenda listings, committee links, and related public meeting content. Much of thisRubyGemsSocket's threat research team is tracking a suspicious RubyGems campaign we’re calling GemStuffer, involving more than 100 gems that appear to use the RubyGems registry as a data transport mechanism rather than a