/
← Voltar ao feed
high cryptocurrency software development

42 Malicious RubyGems Run Install-Time Reverse Shell and Downloader Targeting Crypto Developers

1 fonte(s) · 1 atualização(ões) · publicado 04/10/2026 21:00 · coletado há 4 dias

On October 5, 2026, the RubyGems account reqthrottle_3474 published 42 malicious gems within about an hour. Most are named for cryptocurrency developer tooling (e.g. eth-keystore-utils, bip39-wordlist-utils, btc-wallet-tools), and the last 16 typosquat real gems (bitcion, etheremu.rb, kecack, solaan-ruby). The code runs during gem install or bundle install through a native extension extconf.rb, but only on what looks like a real developer workstation. After a 20-40 minute delay, 11 gems open a reverse shell to 45.138.12[.]177 (ports 8089/8090) and 31 gems download and run wg_install.sh from wgkit.tar.gz. Any workstation that installed one of these gems should be treated as compromised, along with its credentials.

Detalhes técnicos

  • All 42 gem specs declare ext/req_throttle_mini/extconf.rb, which RubyGems executes at install. The Ruby code in lib/ is a benign decoy, and the 31 newer gems add a C file with an empty Init_ function to look like a genuine native extension.
  • Two templates: template A (11 reverse-shell gems) and template B (31 second-stage gems).
  • Anti-analysis checks: abort if CI variables are set (CI, GITHUB_ACTIONS, TRAVIS, JENKINS_URL, GITLAB_CI, CODESPACES), if the hostname is empty, instance, localhost or contains uvm/firecracker/sandbox/vagrant/fc-vm, if the username matches uA+digits or contains sandbox/tester/analys/scanner, or if the working directory is under /opt/rubygems, /var/tmp, /tmp/, /private/var/tmp or /workspace/.
  • Workstation checks: uptime over 30 minutes and presence of .ssh, .gitconfig, .npmrc, .gem/credentials or .bundle in the home directory.
  • If the checks pass, a Base64-encoded Ruby payload is decoded, the process forks twice, calls Process.setsid, redirects stdio to /dev/null, sleeps 1200-2400 seconds and runs the payload with eval.
  • Reverse shell: a Ruby /bin/sh loop over TCP that reconnects every 30 seconds. Ports 8089 are used by req-throttle-mini, bitcoin-rpc-lite, wallet-crypto-utils and web3-eth-utils; the other seven gems use 8090. The shell runs with the privileges of the installing user.
  • Downloader: the URL is stored as hex and XOR-decoded with key usv\x9a to http://45.138.12[.]177:8092/wgkit.tar.gz. It is saved to /tmp/.w1.tgz, extracted to /tmp/.w1/, wg_install.sh is run with bash, then the files are removed. Env vars WG_KIT_URL and WG_FAST appear to be test overrides. The behavior of wg_install.sh is unknown.
  • Template B lacks require 'mkmf', so create_makefile likely fails and shows an install error, but the payload has already started (analyst inference). The account has 48 gems in total, 42 of them malicious.

Remediação

  • Check developer machines and lockfiles for the 42 gems published by reqthrottle_3474; treat any host that installed one as compromised.
  • Rotate SSH keys, RubyGems/npm/Git credentials and any crypto wallet or key material reachable from affected workstations.
  • Block 45.138.12[.]177 (ports 8089, 8090, 8092) and hunt for /tmp/.w1* artifacts and persistent background Ruby processes.
  • Review gems declaring native extensions for unexpected extconf.rb behavior and verify names against typosquats before installing.

Linha do tempo

  1. safedep.io ↗ · pub. 04/10/2026 21:00 · coletado 19/10 18:03 primeiro registro

    42 Malicious RubyGems Run Install-Time Reverse Shell and Downloader Targeting Crypto Developers

    ler a análise desta fonte

    On October 5, 2026, the RubyGems account reqthrottle_3474 published 42 malicious gems within about an hour. Most are named for cryptocurrency developer tooling (e.g. eth-keystore-utils, bip39-wordlist-utils, btc-wallet-tools), and the last 16 typosquat real gems (bitcion, etheremu.rb, kecack, solaan-ruby). The code runs during gem install or bundle install through a native extension extconf.rb, but only on what looks like a real developer workstation. After a 20-40 minute delay, 11 gems open a reverse shell to 45.138.12[.]177 (ports 8089/8090) and 31 gems download and run wg_install.sh from wgkit.tar.gz. Any workstation that installed one of these gems should be treated as compromised, along with its credentials.

    Technical Details

    • All 42 gem specs declare ext/req_throttle_mini/extconf.rb, which RubyGems executes at install. The Ruby code in lib/ is a benign decoy, and the 31 newer gems add a C file with an empty Init_ function to look like a genuine native extension.
    • Two templates: template A (11 reverse-shell gems) and template B (31 second-stage gems).
    • Anti-analysis checks: abort if CI variables are set (CI, GITHUB_ACTIONS, TRAVIS, JENKINS_URL, GITLAB_CI, CODESPACES), if the hostname is empty, instance, localhost or contains uvm/firecracker/sandbox/vagrant/fc-vm, if the username matches uA+digits or contains sandbox/tester/analys/scanner, or if the working directory is under /opt/rubygems, /var/tmp, /tmp/, /private/var/tmp or /workspace/.
    • Workstation checks: uptime over 30 minutes and presence of .ssh, .gitconfig, .npmrc, .gem/credentials or .bundle in the home directory.
    • If the checks pass, a Base64-encoded Ruby payload is decoded, the process forks twice, calls Process.setsid, redirects stdio to /dev/null, sleeps 1200-2400 seconds and runs the payload with eval.
    • Reverse shell: a Ruby /bin/sh loop over TCP that reconnects every 30 seconds. Ports 8089 are used by req-throttle-mini, bitcoin-rpc-lite, wallet-crypto-utils and web3-eth-utils; the other seven gems use 8090. The shell runs with the privileges of the installing user.
    • Downloader: the URL is stored as hex and XOR-decoded with key usv\x9a to http://45.138.12[.]177:8092/wgkit.tar.gz. It is saved to /tmp/.w1.tgz, extracted to /tmp/.w1/, wg_install.sh is run with bash, then the files are removed. Env vars WG_KIT_URL and WG_FAST appear to be test overrides. The behavior of wg_install.sh is unknown.
    • Template B lacks require 'mkmf', so create_makefile likely fails and shows an install error, but the payload has already started (analyst inference). The account has 48 gems in total, 42 of them malicious.

    Remediation

    • Check developer machines and lockfiles for the 42 gems published by reqthrottle_3474; treat any host that installed one as compromised.
    • Rotate SSH keys, RubyGems/npm/Git credentials and any crypto wallet or key material reachable from affected workstations.
    • Block 45.138.12[.]177 (ports 8089, 8090, 8092) and hunt for /tmp/.w1* artifacts and persistent background Ruby processes.
    • Review gems declaring native extensions for unexpected extconf.rb behavior and verify names against typosquats before installing.