Researchers Trace SleeperGem RubyGems Campaign Dropping Persistent Backdoors
Summary
StepSecurity analyzed three RubyGems packages in the SleeperGem campaign, finding CI-evasion checks and a loader that downloads a daemon, installs systemd and cron persistence, and may attempt privilege escalation. The article provides cleanup and credential-rotation 步骤
Key points
- The malicious releases affected git_credential_manager 2.8.0–2.8.3, Dendreo 1.1.3–1.1.4, and fastlane-plugin-run_tests_firebase_testlab 0.3.2; some releases had no matching source-project tags.
- The malware checks for about 30 CI environment variables and exits if it detects them, targeting developer machines rather than CI runners.
- For git_credential_manager 2.8.2 and later, requiring the gem launches a child Ruby process that downloads an installer and native binary from git[.]disroot[.]org; certificate verification is disabled and the User-Agent is set to Git.
- Version 2.8.2 downloads the payload but does not launch the installer; version 2.8.3 runs it, installs a daemon with systemd and cron persistence, and contains a passwordless-sudo privilege-escalation path. The test runner lacked passwordless sudo.
- Harden-Runner captured the process chain and outbound connection to git[.]disroot[.]org. The article says the daemon’s own network behavior was not analyzed and does not establish that credentials were exfiltrated.
- The response guidance is to remove the malicious gems and persistence, check for the setuid shell at /usr/local/sbin/ping6, review network logs, and rotate credentials reachable from affected machines.
Article Details
- Attack Vectors
- Malicious releases of git_credential_manager, Dendreo, and fastlane-plugin-run_tests_firebase_testlab were published to RubyGems.org without matching commits or source-project release tags.
- Requiring git_credential_manager 2.8.2 or later can spawn a child Ruby process that downloads deploy.sh and a native binary from git.disroot.org; version 2.8.3 runs the downloaded script.
- The loader checks for CI environment variables and exits when they are present, targeting developer machines rather than CI runners.
- The installer places the binary under ~/.local/share/gcm/, launches it as a daemon, and configures both a systemd user service and a cron entry for persistence.
- The installer checks sudo and wheel group access; if passwordless sudo is available, it runs as root and plants a setuid shell at /usr/local/sbin/ping6.
- Defensive Notes
- If an affected gem was installed or required on a developer machine, treat the machine and reachable secrets as compromised and rotate credentials.
- Remove the dropped daemon and persistence, and inspect /usr/local/sbin/ping6 for a setuid shell.
- Search lockfiles for the malicious gem versions and review network logs for connections to git.disroot.org.
- Use outbound-connection monitoring and allowlisting to detect or block unexpected destinations; scan developer machines for the loader, installer, and persistence artifacts.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| HOSTNAME | git[.]disroot[.]org | Attacker-used command-and-control host that served deploy.sh and the native binary. |
MITRE ATT&CK
T1036.004 · Masquerade Task or ServiceThe systemd service and cron persistence use the name git-credential-manager, matching the name of the tool the malicious gem impersonates.T1053.003 · CronThe installer also creates a cron entry to restart the dropped daemon.T1059 · Command and Scripting InterpreterRequiring the compromised gem starts a child Ruby process that runs the bundled install script.T1059.004 · Unix ShellThe install process invokes /bin/sh to run the downloaded deploy.sh script.T1105 · Ingress Tool TransferThe loader downloads deploy.sh and a native binary from git.disroot.org.T1195.001 · Compromise Software Dependencies and Development ToolsAttackers published malicious versions of three RubyGems packages without matching commits or release tags in the source projects.T1480.001 · Environmental KeyingThe malware checks for CI environment variables and exits when they are present, allowing it to run on developer machines while avoiding CI environments.T1543.002 · Systemd ServiceThe dropped daemon installs a systemd user service for persistence.T1548.001 · Setuid and SetgidWhen passwordless sudo is available, the installer runs as root and plants a setuid root shell at /usr/local/sbin/ping6.
Products
Dendreoare git_credential_manager, which impersonates the official Microsoft Git Credential Manager, along with Dendreo and fastlane-plugin-run_tests_firebase_testlab. Each malicious release is a loader. It fetches a secondfastlane-plugin-run_tests_firebase_testlabimpersonates the official Microsoft Git Credential Manager, along with Dendreo and fastlane-plugin-run_tests_firebase_testlab. Each malicious release is a loader. It fetches a second stage from an attackergit_credential_managerin a coordinated supply chain attack that researchers named SleeperGem. The compromised gems are git_credential_manager, which impersonates the official Microsoft Git Credential Manager, along with Dendreo and
Tools
StepSecurity Dev Machine GuardCI and targets developer laptops, developer machines are the primary exposure surface. StepSecurity Dev Machine Guard scans developer machines for malicious files using its suspicious files detection, so it can flagStepSecurity Harden-Runnerfor years before suddenly shipping new versions. StepSecurity ran every compromised version inside Harden-Runner in audit mode to capture the full kill chain, and this post walks through exactly what we observed.