Sleepergem Gemsource Droppedbinary Persistence

Duo Tech@duotech

•updated Jul 27, 2026•0•0•4

Detects SleeperGem RubyGems supply chain artifacts: hardcoded Forgejo C2 reference in gem Ruby source, the git-credential-manager binary dropped under the hidden gcm path, and supporting deploy.sh/persistence indicators (ping6 backdoor, systemd/cron service under the git-credential-manager name)