GoKawiilA new threat campaign is using RubyGems as a dead drop to store exfiltrated data, but the attacker's long-term plans are less clear.
Software development security vendor Socket published research concerning a campaign dubbed "GemStuffer," where an attacker abused the RubyGems package registry "as a data transport mechanism rather than a conventional malware distribution channel," according to a blog post. RubyGems is a package manager for the Ruby programming language, and acts as a way for developers to distribute Ruby programs or libraries, which are referred to as "gems."
On the surface, this would look like any number of attacks impacting the open source development supply chain in recent months. There are the Shai-Hulud self-propagating worms, novel ways to compromise open source AI models, and countless attacks against the NPM package ecosystem.
But in this case, the primary victim is unclear, as is the full scope of the threat activity. What organizations need to pay attention to is what the attacker might be planning next and how they can prepare.
Related:It's Patch Tuesday for Microsoft & Not a Zero-Day In Sight
GemStuffer Hints at Bigger Attacks
In this case, GemStuffer concerns more than 100 gems that appear to use RubyGems as a dead drop for data rather than to distribute conventional malware. The attackers are publishing a large number of packages with few or even no downloads that contain payloads that are "repetitive, noisy, and unusually self-contained," according to Socket.
The scripts within the packages merely fetch pages from UK local government portals used by the Lambeth, Wandsworth, and Southwark districts in London; scraped data includes council calendar pages, agenda listings, committee link, and other such public-facing information. This data is then published back to RubyGems as .gem archives through hardcoded API keys.
"In some samples, the payload creates a temporary RubyGems credential environment under /tmp, overrides HOME, builds a gem locally, and pushes it to rubygems.org," the blog post read. "Other variants skip the gem CLI entirely and POST the archive directly to the RubyGems API."
The attacker later downloads the package from RubyGems and extracts the data. No command-and-control (C2) server needed.
... continue reading