SleeperGem attack targets Ruby ecosystem with malicious gems

A new software supply chain attack, codenamed SleeperGem, has been identified targeting the Ruby ecosystem. The attack involves malicious gems published to RubyGems, designed to deliver further payloads to unsuspecting users, according to a recent report by The Hacker News.

The SleeperGem attack utilizes three malicious Ruby gems: git_credential_manager, Dendreo, and fastlane-plugin-run_tests_firebase_testlab. These gems, some of which were dormant for years, impersonate legitimate tools and fetch secondary payloads from attacker-controlled servers. The malware specifically targets developer machines, avoiding build systems by scanning for environment variables related to CI/CD platforms like GitHub Actions and GitLab.

Upon detection of a developer environment, it installs a native daemon and establishes persistence through cron jobs and systemd services. The git_credential_manager gem, in particular, mimics Microsoft's Git Credential Manager. If the malware gains root privileges, it can plant a setuid root copy of the system shell. Users who have installed these gems are advised to consider their systems compromised, remove the malicious daemon, and rotate all credentials.

Source: The Hacker News