Fallout in ruby, Sep 21 – Sep 27

What we caught this week while monitoring over 181,645,109 artifacts across 51 ecosystems. Campaigns that impact multiple packages are collapsed into a single entry with their siblings.

FRIDAY

Fri Sep 25 · 1 catch · 0 waves · 1 single
objectives/command-and-controlwell-known/appwell-knownmicro-behaviors/communicationsmicro-behaviorsmetadatametadata/binaryobjectives/anti-staticobjectives/credential-accessobjectivesobjectives/evasion+26 2d
pwn 0.5.749 ruby 1,135,168 installs 2 days ago

Offensive security tool with exploit capabilities

security-bypass/access-listllm/override

WEDNESDAY

Wed Sep 23 · 1 catch · 0 waves · 1 single
micro-behaviors/communicationsmicro-behaviorsmetadatametadata/buildmicro-behaviors/osmetadata/importobjectives/exfiltrationobjectivesobjectives/supply-chain 5d
kerokwis 99 ruby 57 installs ✓ 5 days ago

Install hook exfiltrates hostname

install-hook/extconfoob/system-profile

TUESDAY

Tue Sep 22 · 1 catch · 0 waves · 1 single
well-known/appwell-knownmicro-behaviors/communicationsmicro-behaviorsmetadatametadata/binaryobjectives/anti-staticobjectives/privilege-escalationobjectivesobjectives/supply-chainmetadata/package+26 6d
pwn 0.5.744 ruby 1,114,862 installs 6 days ago

Offensive security framework with evasion

elevation-control/sudopackage/rubygems

MONDAY

Mon Sep 21 · 1 catch · 0 waves · 1 single
micro-behaviors/communicationsmicro-behaviorsmetadata/buildmetadataobjectives/command-and-controlobjectives/discoveryobjectives/evasionobjectives/anti-staticobjectivesobjectives/supply-chainmetadata/package+11 6d
blockchain_wallet 0.0.6.gem.a1528c5f ruby ✓ 6 days ago

Crypto miner with persistence and C2

payload/encryptedpackage/rubygems
O objectives H behaviours Md metadata · a group subscript counts categories, an atom subscript subcategories