Supply Chain Attack Campaign
“GemStuffer” is a coordinated campaign that abuses the RubyGems package registry as a covert exfiltration channel to steal and archive data from UK local government council portals. The malware harvests system context, scrapes public-facing council meeting and agenda pages, packages the collected data into .gem archives, and silently uploads them to RubyGems using hardcoded API keys.
Ecosystems: rubygems
GemStuffer abuses RubyGems as an exfiltration channel, packaging scraped UK council portal data into junk gems published from new accounts.