Malicious RubyGems Packages Deploy Reverse Shells and Cryptocurrency-Theft Toolkit
Summary
Researchers identified 42 malicious RubyGems packages that use reverse shells or a toolkit to hijack cryptocurrency transactions and steal wallet data. The article details the malware’s delivery, persistence, and operation.
Key points
- The packages use typosquatting, crypto-brand names, and generic utility names to target crypto and web3 developers.
- One variant delays execution, evades analysis environments, and opens a reverse shell; another downloads a cryptocurrency-theft toolkit.
- The toolkit installs a trusted root certificate and local proxy to intercept exchange traffic and replace withdrawal addresses while displaying the original address.
- A grabber monitors the clipboard and searches browsers, wallet files, and user directories for wallet data, seed phrases, and private keys.
- The malware persists through shell configuration and desktop autostart entries, and sends stolen material to a remote collector.
- The article recommends checking for the bundled root CA, unexpected proxy settings, autostart entries, and a listener on 127.0.0.1:8899; affected users should move funds and change exposed credentials from a clean device.
Article Details
- Attack Vectors
- Malicious RubyGems packages use typosquatting, brandjacking, and generic utility names to target crypto and web3 developers.
- A delayed payload in ext/req_throttle_mini/extconf.rb evades CI, sandbox, and analysis environments, then either opens a reverse shell or downloads and installs a second-stage toolkit.
- The toolkit installs a trusted root certificate and local proxy to intercept targeted exchange traffic, inject JavaScript, and replace withdrawal addresses while concealing the change in the victim's browser.
- The toolkit monitors and replaces cryptocurrency addresses in the clipboard, and searches local files and browser-wallet storage for wallet secrets to exfiltrate.
- Defensive Notes
- Check endpoints for the bundled root CA, modified proxy settings, unexpected autostart entries, and a listener on 127.0.0.1:8899.
- Treat wallet or exchange secrets present on an affected host as compromised. From a clean device, move funds to a newly created wallet and change exchange passwords, API keys, and 2FA.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 45[.]138[.]12[.]177 | Malware C2 host used for reverse-shell connections, toolkit delivery, and data collection. |
| SHA256 | 075b6ac656aa414e2d21b9d1bc8b0fd030902202222e9d06a326fd80d7827ae6 | SHA-256 of the root certificate installed by the malicious toolkit for TLS interception. |
| SHA256 | 33276fedf0632be39b4e8a646c520bfa081bb7e67dce52042da46bbbda16d440 | SHA-256 of the malicious wgkit.tar.gz second-stage toolkit archive. |
| SHA256 | 387a778a6376b6c060516ce5c1191a61e075acfe3fb073e6e5cd78eeb96a95b3 | SHA-256 of the malicious _grab.py wallet-data collection component. |
| SHA256 | 549d35217f1e884634993ba6f13dd8e82091dd9f995a9ed0cb575958e63f073d | SHA-256 of the malicious inject_proxy.py traffic-interception component. |
| SHA256 | 57a56ab47fa7f33147d4924b07e77d773515b4a06ca9ac090874209a9950f30b | SHA-256 of the malicious browser content script that replaces withdrawal addresses. |
| SHA256 | b857fdf59db6948ea01643d935742904e9275572e63cd23331a9405483c6379c | SHA-256 of the malicious wg_install.sh installer. |
| URL | hxxp[:]//45[.]138[.]12[.]177:8080/w | Remote collector fallback URL used by the injected browser script. |
| URL | hxxp[:]//45[.]138[.]12[.]177:8080/wi/grab | Default C2 endpoint used by the grabber to exfiltrate collected wallet data. |
MITRE ATT&CK
T1005 · Data from Local SystemThe grabber searches browser-wallet storage, wallet files, and user directories for secrets and seed material.T1041 · Exfiltration Over C2 ChannelCollected wallet data is sent to the remote collector through HTTP.T1059.004 · Unix ShellThe reverse-shell variant attaches its connection to /bin/sh, and the installer executes shell commands.T1105 · Ingress Tool TransferThe second variant downloads wgkit.tar.gz from the remote host and extracts it as a second-stage payload.T1115 · Clipboard DataThe grabber monitors the clipboard, exfiltrates copied cryptocurrency addresses, and replaces them with operator wallets.T1185 · Browser Session HijackingInjected browser JavaScript alters withdrawal submissions and displayed address values in targeted exchange pages.T1195.001 · Compromise Software Dependencies and Development ToolsMalicious packages were published to RubyGems to deliver the malware to developers.T1497.001 · System ChecksThe payload checks for CI, sandbox, and analysis environments before activating.T1547.013 · XDG Autostart EntriesThe installer creates wg.desktop and wg-grab.desktop entries in the user's autostart directory.T1557 · Adversary-in-the-MiddleThe local proxy intercepts targeted HTTPS traffic using an installed root certificate and modifies exchange responses.