SleeperGem loader contacting Forgejo C2 git.disroot.org for deploy script or binary

Duo Tech@duotech

•updated Jul 27, 2026•0•0•2

Detects network traffic consistent with the SleeperGem loader communicating with a Forgejo instance hosted on git.disroot.org. The detection looks for GET requests containing specific path patterns (e.g., '/git-ecosystem/', '/raw/branch/main/') and file extensions (deploy.sh or git-credential-manager), along with a 'Git' user-agent, which is characteristic of the loader's C2 retrieval activity.