The GemStuffer campaign represents a sophisticated supply chain attack targeting the Ruby software ecosystem to steal and exfiltrate sensitive government data through malicious RubyGems packages. First observed in May 2026, the GemStuffer operation specifically targets the United Kingdom government sector, focusing on UK local government democratic services portals powered by ModernGov software. The GemStuffer campaign exploits the RubyGems Package Registry, Ruby Runtime Environments, and CI/CD pipelines to conduct covert data theft operations against government infrastructure.
The GemStuffer attack methodology involves injecting malicious Ruby scripts into compromised CI/CD pipelines, Bundler configurations, and gem installation hooks to scrape meeting calendars, agenda records, PDF documents, and contact information from UK local government portals. The stolen government data is then packaged into fake Ruby gem archives and exfiltrated through the legitimate RubyGems publishing infrastructure. The GemStuffer campaign demonstrates exceptional stealth and technical sophistication by using temporary staging directories, hardcoded RubyGems API keys, and legitimate gem publishing workflows to disguise data exfiltration traffic as normal developer activity.
The GemStuffer operation stands out for its ability to blend malicious activity into routine software development operations, making detection significantly more difficult for security teams. By abusing the trusted RubyGems package registry and leveraging legitimate Ruby ecosystem workflows, the GemStuffer campaign successfully exfiltrates sensitive UK government data while evading traditional security controls through supply chain compromise tactics.
The GemStuffer supply chain campaign abuses the Ruby ecosystem to quietly scrape sensitive government data and exfiltrate information through seemingly legitimate RubyGems packages. The GemStuffer operation relies on malicious Ruby scripts disguised under filenames including payload.rb, exploit.rb, extconf.rb, yard_plugin.rb, and fetcher.rb, which are introduced into target Ruby environments through multiple attack vectors. These GemStuffer malicious scripts are delivered through compromised Bundler configurations, poisoned CI/CD pipelines, tampered gem post-install hooks, or malicious developer dotfile repositories targeting Ruby development environments.
Once GemStuffer malicious scripts execute on compromised systems, the implant immediately gathers execution context including timestamps, working directories, script paths, and command-line arguments. The GemStuffer malware embeds this environmental metadata alongside stolen content to provide threat actors with detailed insight into the infected Ruby environment. This reconnaissance capability allows GemStuffer operators to understand the compromised system's configuration and optimize subsequent data collection operations.
At the center of the GemStuffer campaign is a targeted web-scraping operation focused on UK local government democratic services portals powered by ModernGov software. Using Ruby's built-in Net::HTTP library, the GemStuffer malware connects to hardcoded ModernGov-powered council sites including Lambeth, Wandsworth, and Southwark government portals. The GemStuffer scripts harvest meeting calendars and committee agenda pages from mgCalendarMonthView.aspx endpoints on these UK government websites.
The GemStuffer malware then parses the returned HTML from UK government portals to identify links tied to agenda listings and committee records before issuing additional HTTP requests to collect full meeting details, officer contact information, RSS feed data, and linked PDF documents from government systems. To blend into normal traffic patterns, the GemStuffer implant spoofs a minimal Mozilla/5.0 User-Agent string while deliberately suppressing SSL certificate verification errors during outbound requests to UK government portals.
After gathering government data from UK portals, the GemStuffer malware packages stolen content into fully functional Ruby gem archives created inside temporary directories under /tmp on compromised systems. The GemStuffer operation embeds scraped government information into files such as lib/result.txt or README within the malicious gem package, alongside intentionally minimal gemspec metadata using placeholder author names and generic summaries to avoid drawing attention from security monitoring.
The GemStuffer malware uses File.binwrite instead of the more common File.write method to safely handle raw non-UTF-8 HTTP response data from government websites, reflecting a high level of familiarity with Ruby internals and data handling. Some GemStuffer variants further reduce forensic visibility by generating temporary directories with Dir.mktmpdir and automatically deleting the staging environment immediately after the malicious gem package is prepared, minimizing artifacts left on compromised Ruby systems.
The final stage of GemStuffer operations turns RubyGems itself into a covert exfiltration channel for stolen government data. The GemStuffer implant creates a fake RubyGems environment under /tmp/gemhome/.gem/ on compromised systems, injects hardcoded API credentials into a locally generated credentials file, adjusts file permissions to satisfy gem client requirements, and overrides the HOME environment variable before pushing the malicious package containing stolen government data to rubygems.org.
Other GemStuffer variants bypass the gem client entirely and directly upload the malicious gem archive containing exfiltrated government data through crafted HTTP POST requests to the RubyGems API endpoint. Security researchers observed the GemStuffer campaign using multiple RubyGems API keys, likely as a resilience mechanism to ensure the exfiltration operation remains operational even if individual API keys are revoked by RubyGems administrators. From a network perspective, the GemStuffer exfiltration activity appears nearly identical to legitimate developer behavior, consisting of a single outbound TLS connection carrying a gzip-compressed gem archive, making the data exfiltration especially difficult to distinguish from normal software publishing traffic on Ruby development systems.
Run gem yank commands for each confirmed GemStuffer package name and version associated with the data theft campaign. File an abuse report with rubygems.org requesting emergency removal of the full GemStuffer malicious package set, as yanked gems may still be cached by mirror servers. Organizations should maintain an updated blocklist of known GemStuffer malicious gem packages to prevent installation on Ruby development systems.
Search /tmp directories on all potentially affected Ruby-enabled machines for GemStuffer artifacts matching patterns including lambeth71b, rubydocran_, /tmp/gemhome/, and any directory following the pattern /tmp/[a-z]+[0-9]+[a-z]+[epoch_timestamp][pid]/. Preserve and forensically image any GemStuffer matches before deletion to support incident response and threat intelligence operations. Organizations should implement continuous monitoring of temporary directory creation patterns to detect future GemStuffer activity.
Audit Bundler configuration files including .bundlerc, Gemfile, and config/application.rb for references to GemStuffer malicious scripts. Review gem post-install hooks, CI pipeline definitions, and dotfile repositories for references to evil.rb, hack.rb, script.rb, payload.rb, exploit.rb, extconf.rb, fetcher.rb, yardload.rb, or yard_plugin.rb filenames associated with GemStuffer operations. Organizations should implement code review processes for all Ruby gem dependencies and CI/CD pipeline modifications to prevent GemStuffer compromise.
Deploy runtime security tooling such as Falco or eBPF-based syscall monitors to alert on putenv/setenv system calls that redirect HOME environment variables from /home or /root to /tmp paths within production Ruby processes. This HOME environment manipulation is an abnormal operation in legitimate Ruby applications and represents a key indicator of GemStuffer malware activity on compromised systems.
For CI workflows that do not legitimately publish to rubygems.org, add egress firewall rules blocking HTTPS POST requests to rubygems.org/api/v1/gems to prevent GemStuffer data exfiltration. For Ruby pipelines that do publish legitimate gems, restrict allowed gem names to an explicit allowlist and implement monitoring for unexpected gem publishing activity that could indicate GemStuffer compromise.
Restrict write access to /tmp directories in production containers where Ruby workloads run to prevent GemStuffer malware from creating staging directories. Use read-only filesystem mounts where possible and monitor for credential file creation under non-standard HOME paths that could indicate GemStuffer operations. Organizations should implement least-privilege access controls on Ruby development systems to limit GemStuffer impact.
Enable notifications for new gem publications under organizational RubyGems accounts to detect unauthorized GemStuffer publishing activity. Audit RubyGems API key scopes and rotate keys on a regular cadence to limit exposure from compromised credentials. Note that RubyGems temporarily disabled new account registration in response to the broader spam-publishing campaign that overlaps with GemStuffer activity.
Reconnaissance: T1592 (Gather Victim Host Information)
Resource Development: T1608 (Stage Capabilities)
Initial Access: T1190 (Exploit Public-Facing Application)
Execution: T1059.006 (Python)
Defense Evasion: T1036.005 (Match Legitimate Name or Location), T1564.002 (Hidden Users)
Collection: T1213 (Data from Information Repositories), T1119 (Automated Collection)
Exfiltration: T1567 (Exfiltration Over Web Service)
Command and Control: T1071.001 (Web Protocols), T1132 (Data Encoding)
Discovery: T1057 (Process Discovery)
Malicious Ruby Script Filenames: payload.rb, script.rb, evil.rb, yardload.rb, yard_plugin.rb, exploit.rb, extconf.rb, fetcher.rb
Targeted UK Government Portal URLs: hxxps[:]//moderngov[.]lambeth[.]gov[.]uk/mgCalendarMonthView[.]aspx?M=1&Y=2026&GL=1&bcr=1, hxxps[:]//democracy[.]wandsworth[.]gov[.]uk/mgCalendarMonthView[.]aspx?M=1&Y=2026&GL=1&bcr=1, hxxps[:]//moderngov[.]southwark[.]gov[.]uk/mgCalendarMonthView[.]aspx?M=1&Y=2026&GL=1&bcr=1
File System Artifacts: /tmp/<package><epoch_timestamp><pid>/, /tmp/<package><epoch_timestamp><pid>/lib/result.txt, /tmp/<package><epoch_timestamp><pid>/lib/x.rb, /tmp/<package><epoch_timestamp><pid>/x.gemspec, /tmp/<package><epoch_timestamp><pid>/<package>-0.0.2.gem, /tmp/gemhome/.gem/credentials, /tmp/gemhome/, /tmp/rubydocran_*
Malicious Gem Package Indicators: s.summary='result', s.summary='o', s.authors=['x'], s.authors=['a'], s.authors=['south']
SHA256 Hashes: 239440c830e17530dda0a8a06ed27088609987 50a1e3ed2239e919465dc59420, c2d6bcacc88177e0f2c8c262726f86f37e671b1692c8bc135bac4b610ddcf31a
SHA1 Hashes: 5f924c0454f1fb6b2299d658c3bb4e75ce3d0b66, db9827ae2c004a4dc6009be2d009477bff5249df
MD5 Hashes: 81c34eea9c853c5ec13a3b3cd4a2228b, 9211506ae02c9e4e75aeadfebeb4883c
Socket.dev - GemStuffer Campaign Analysis
