GemStuffer Abuses 150+ RubyGems to Exfiltrate Scraped U.K. Council Portal Data

GemStuffer is a cybersecurity campaign that abuses the RubyGems repository to exfiltrate scraped data from U.K. government portals rather than distributing malware.

• •The campaign uses 150+ malicious gems with junk names to stage and distribute scraped council portal content
• •Attacker fetches pages from U.K. local government democratic services portals and packages HTTP responses into .gem archives for distribution
• •Malicious gems either use CLI commands with hardcoded credentials to publish to RubyGems, or directly upload archives via HTTP POST API requests
• •Targets ModernGov portals (Lambeth, Wandsworth, Southwark) to collect committee calendars, agendas, PDFs, officer contacts, and RSS feeds
• •The systematic bulk collection suggests potential pivot point testing against government infrastructure or proof-of-concept of package registry abuse