Attackers Weaponize RubyGems for Data Dead Drops

Summary

Attackers have published RubyGems packages containing scraper code that targets public-facing UK government servers. The packages appear designed for data exfiltration or reconnaissance, though the threat actors' ultimate objective remains unclear. This represents a supply chain attack leveraging the Ruby package ecosystem.

Indicators of Compromise

• malware — RubyGems malicious packages (unspecified)

Entities